texmod: Stricter file name validation

This commit is contained in:
Lars Mueller 2023-05-27 14:27:49 +02:00
parent 8e5bdc817c
commit 73640f11d1
3 changed files with 5 additions and 1 deletions

@ -11,6 +11,8 @@ setmetatable(texmod, {__call = new})
-- Constructors / "generators"
function texmod.file(filename)
-- See `TEXTURENAME_ALLOWED_CHARS` in Minetest (`src/network/networkprotocol.h`)
assert(not filename:find"[^%w_.-]", "invalid characters in file name")
return new{
type = "file",
filename = filename

@ -251,6 +251,9 @@ function rm.fname(r)
-- This is overly permissive, as is Minetest;
-- we just allow arbitrary characters up until a character which may terminate the name.
-- Inside an inventorycube, `&` also terminates names.
-- Note that the constructor will however - unlike Minetest - perform validation.
-- We could leverage the knowledge of the allowed charset here already,
-- but that might lead to more confusing error messages.
return r:match_str(r.invcube and "[^:^&){]" or "[^:^){]")
end
function rm.subtexp(r)

@ -123,7 +123,6 @@ return function(self, write_str)
end
function w.tex(tex)
if tex.type == "file" then
assert(not tex.filename:find"[:^\\&{[]", "invalid character in filename")
w.str(tex.filename)
return
end