Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Alternate logic can break out of DLC folder siloing #166

Closed
Mgamerz opened this issue Nov 2, 2020 · 1 comment
Closed

Alternate logic can break out of DLC folder siloing #166

Mgamerz opened this issue Nov 2, 2020 · 1 comment
Labels
bug Something isn't working security

Comments

@Mgamerz
Copy link
Member

Mgamerz commented Nov 2, 2020

A malformed (or malicious) moddesc.ini that has installation routines outside of it's scoped DLC folder can install files outside of it's mod and into other mods. Mod Manager partially protects against this currently by identifying mod folder targets and wiping them out before install. However, it should prevent alternate logic from installing outside of the designated task headers, e.g. basegame should not allow touching DLC, alternates should not be able to escape their siloed job, custom dlc alternates should be forced to remain in scope of their listed dlc folders.
@Mgamerz Mgamerz added bug Something isn't working security labels Nov 2, 2020
Mgamerz added a commit that referenced this issue Nov 17, 2020
@Mgamerz
Initial security for scoping silos on mod headers. Part of #166
46f1da3
@Mgamerz
Copy link
Member Author

Mgamerz commented Nov 21, 2020

This should be fixed as part of #167 .

@Mgamerz Mgamerz closed this as completed Nov 21, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@Mgamerz