mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-10-14 23:10:33 +02:00
499cdd55ad
Texture pack installs took the destination directory from the archive's textures.ini, and PKG update installs from the PBOOT's DISC_ID, both unchecked, so a crafted archive or package could write outside PSP/TEXTURES or PSP/GAME. Add IsSafePathComponent() to PathUtil and check both, replacing the WebServer's own upload filename check with it too. DISC_ID from any PARAM.SFO also names configs, cheats, textures, exdata and savestates, so ReadSFO now drops one that isn't a safe name and the game gets a fake ID like homebrew. The same goes for a frame dump's ID. Combines #22419 and #22420 by Acts1631. Co-Authored-By: Acts1631 <acts1631kjv@proton.me> Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>