fix: validate datapack update filenames and enforce path containment#3046
Merged
DotnetInstall merged 2 commits intoJun 12, 2026
Merged
Conversation
pcl-ce-automation
Bot
added
🛠️ 等待审查
审阅者指南在 datapack 更新流程中新增文件名校验和路径包含性检查，以防止路径遍历；并重构更新逻辑，仅对已验证的条目进行操作，同时相应调整进度统计与用户反馈。 经过校验的 datapack 更新流程图flowchart TD
Start([UpdateResource called]) --> Init[Initialize fileList, fileCopyList, updateEntryList, tempRoot, datapackRoot, skippedUnsafeFileCount]
Init --> ForEachEntry{{For each Entry in datapackList}}
ForEachEntry --> CheckAvailable{Entry.UpdateFile.Available}
CheckAvailable -- No --> ForEachEntry
CheckAvailable -- Yes --> ValidateFileName[TryGetSafeDatapackUpdateFileName]
ValidateFileName -- Fail --> IncSkip[Increment skippedUnsafeFileCount and log]
IncSkip --> ForEachEntry
ValidateFileName -- Pass --> BuildTemp[TryBuildDatapackUpdatePath with tempRoot]
BuildTemp -- Fail --> IncSkip
BuildTemp -- Pass --> BuildReal[TryBuildDatapackUpdatePath with datapackRoot]
BuildReal -- Fail --> IncSkip
BuildReal -- Pass --> QueueUpdate[Add to fileList, fileCopyList, updateEntryList]
QueueUpdate --> ForEachEntry
ForEachEntry --> AfterLoop[After loop]
AfterLoop --> CheckSkipped{skippedUnsafeFileCount > 0}
CheckSkipped -- Yes --> ShowHint[ModMain.Hint about skipped unsafe filenames]
CheckSkipped -- No --> CheckFiles
ShowHint --> CheckFiles{fileList.Any}
CheckFiles -- No --> EndReturn[Return]
CheckFiles -- Yes --> CreateLoaders[Create LoaderDownload and LoaderTask]
CreateLoaders --> SetWeight[Set ProgressWeight = updateEntryList.Count * 1.5]
SetWeight --> ReplaceFiles[LoaderTask deletes old files for updateEntryList]
ReplaceFiles --> End[End]
文件级更改
技巧与命令与 Sourcery 交互
自定义你的体验访问你的 控制面板 即可：
获取帮助Original review guide in EnglishReviewer's GuideAdds filename validation and path containment checks to the datapack update flow to prevent path traversal, and refactors the update logic to operate only on validated entries while adjusting progress accounting and user feedback accordingly. Flow diagram for validated datapack update processflowchart TD
Start([UpdateResource called]) --> Init[Initialize fileList, fileCopyList, updateEntryList, tempRoot, datapackRoot, skippedUnsafeFileCount]
Init --> ForEachEntry{{For each Entry in datapackList}}
ForEachEntry --> CheckAvailable{Entry.UpdateFile.Available}
CheckAvailable -- No --> ForEachEntry
CheckAvailable -- Yes --> ValidateFileName[TryGetSafeDatapackUpdateFileName]
ValidateFileName -- Fail --> IncSkip[Increment skippedUnsafeFileCount and log]
IncSkip --> ForEachEntry
ValidateFileName -- Pass --> BuildTemp[TryBuildDatapackUpdatePath with tempRoot]
BuildTemp -- Fail --> IncSkip
BuildTemp -- Pass --> BuildReal[TryBuildDatapackUpdatePath with datapackRoot]
BuildReal -- Fail --> IncSkip
BuildReal -- Pass --> QueueUpdate[Add to fileList, fileCopyList, updateEntryList]
QueueUpdate --> ForEachEntry
ForEachEntry --> AfterLoop[After loop]
AfterLoop --> CheckSkipped{skippedUnsafeFileCount > 0}
CheckSkipped -- Yes --> ShowHint[ModMain.Hint about skipped unsafe filenames]
CheckSkipped -- No --> CheckFiles
ShowHint --> CheckFiles{fileList.Any}
CheckFiles -- No --> EndReturn[Return]
CheckFiles -- Yes --> CreateLoaders[Create LoaderDownload and LoaderTask]
CreateLoaders --> SetWeight[Set ProgressWeight = updateEntryList.Count * 1.5]
SetWeight --> ReplaceFiles[LoaderTask deletes old files for updateEntryList]
ReplaceFiles --> End[End]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a2dc12259e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
whitecat346
approved these changes
Jun 10, 2026
lhx077
force-pushed
the
codex/fix-path-traversal-vulnerability-in-datapack-updates
branch
from
a2dc122 to
d2bbb00
Compare
DotnetInstall
approved these changes
Jun 12, 2026
pcl-ce-automation
Bot
added
🕑 等待合并
pcl-ce-automation
Bot
added
👌 完成
DotnetInstall
deleted the
codex/fix-path-traversal-vulnerability-in-datapack-updates
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
FileNamewas concatenated into temporary anddatapacksdestinations without sanitization or containment checks.Description
TryGetSafeDatapackUpdateFileNameto validate remoteCompFile.FileNameis non-empty, ends with.zip, contains no path separators/invalid characters and is a plain filename (no./..).TryBuildDatapackUpdatePathto build full paths withPath.GetFullPathand verify the destination is contained inside the intended root directory before using it.UpdateResourceinPageInstanceSavesDatapack.xaml.csto skip unsafe entries, log/notify skips, and only queue downloads and delete/replace files for entries that passed validation; updated download progress weighting to count only validated entries.Path.Combine/full-path checks when constructing temporary and final paths.Testing
git diff --checkto detect whitespace/merge issues (passed).dotnet build 'Plain Craft Launcher 2/Plain Craft Launcher 2.csproj' -c CI --no-restore, but the environment is missingdotnetso a full build could not be executed.Codex Task
Summary by Sourcery
验证数据包更新文件名，并确保更新路径保持在预期目录内，以防止在数据包更新过程中发生不安全的文件写入。
Bug Fixes:
Enhancements:
Original summary in English
Summary by Sourcery
Validate datapack update filenames and ensure update paths remain within the expected directories to prevent unsafe file writes during the datapack update process.
Bug Fixes:
Enhancements: