Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

get_ipc_path: Validate file paths, in case of broken symlinks #203

Merged
merged 1 commit into from
Feb 27, 2023
Merged

get_ipc_path: Validate file paths, in case of broken symlinks #203

merged 1 commit into from
Feb 27, 2023

Conversation

flibitijibibo
Copy link
Contributor

@TheSpookyCat
Copy link
Collaborator

Can merge once tested

@flibitijibibo
Copy link
Contributor Author

Standalone test:

test.py:

import os
import sys

full_path = os.path.abspath(".")
if sys.platform == 'win32' or os.path.isdir(full_path):
    for entry in os.scandir(full_path):
        if entry.name.startswith("discord-ipc"): # and os.path.exists(entry):
            print(entry.path)

test.sh:

cd "`dirname "$0"`"
mkdir -p app/com.discordapp.Discord
touch app/com.discordapp.Discord/discord-ipc-3
for i in {0..9}; do
    test -S ./discord-ipc-$i || ln -sf {app/com.discordapp.Discord,.}/discord-ipc-$i;
done
python test.py

Before:

/home/flibitijibibo/Programming/pypresencetest/discord-ipc-4
/home/flibitijibibo/Programming/pypresencetest/discord-ipc-5
/home/flibitijibibo/Programming/pypresencetest/discord-ipc-3
/home/flibitijibibo/Programming/pypresencetest/discord-ipc-1
/home/flibitijibibo/Programming/pypresencetest/discord-ipc-9
/home/flibitijibibo/Programming/pypresencetest/discord-ipc-0
/home/flibitijibibo/Programming/pypresencetest/discord-ipc-6
/home/flibitijibibo/Programming/pypresencetest/discord-ipc-7
/home/flibitijibibo/Programming/pypresencetest/discord-ipc-2
/home/flibitijibibo/Programming/pypresencetest/discord-ipc-8

After:

/home/flibitijibibo/Programming/pypresencetest/discord-ipc-3

@flibitijibibo
Copy link
Contributor Author

Looks like one of the dependencies has a CVE? Can't see a capped version in the repo so I guess this is GitHub's problem for the moment 😅

@TheSpookyCat
Copy link
Collaborator

TheSpookyCat commented Feb 27, 2023

Thanks!
oops wrong button
Looking into the CVE now

@TheSpookyCat TheSpookyCat reopened this Feb 27, 2023
@TheSpookyCat TheSpookyCat merged commit 6903209 into qwertyquerty:master Feb 27, 2023
@flibitijibibo flibitijibibo deleted the patch-1 branch February 27, 2023 16:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

get_ipc_path does not validate paths from scandir
2 participants