bigjakk/Krunker-Civilian-Client-Test
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

fix: prevent path traversal in theme and background loading

Browse Source
This commit is contained in:
bigjakk
2026-04-10 13:19:54 -07:00
parent a38f3a7a25
commit d6767327e8
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/css-themes.ts
+4 -2
View File
@@ -32,7 +32,8 @@ export function getThemeCSS(themeId: string, swapDir: string): string {
if (themeId === 'disabled' || !themeId) return ''; if (themeId === 'disabled' || !themeId) return '';
const prefix = 'user:'; const prefix = 'user:';
if (!themeId.startsWith(prefix)) return ''; if (!themeId.startsWith(prefix)) return '';
const filename = themeId.slice(prefix.length); const filename = basename(themeId.slice(prefix.length));
if (!filename) return '';
try { try {
return readFileSync(join(swapDir, 'themes', filename), 'utf-8'); return readFileSync(join(swapDir, 'themes', filename), 'utf-8');
} catch { return ''; } } catch { return ''; }
@@ -106,7 +107,8 @@ export function getLoadingScreenCSS(loadingTheme: string, backgroundUrl: string,
} catch { /* read failed */ } } catch { /* read failed */ }
} }
} else if (loadingTheme.startsWith('swap:')) { } else if (loadingTheme.startsWith('swap:')) {
const filename = loadingTheme.slice(5); const filename = basename(loadingTheme.slice(5));
if (!filename) return '';
try { try {
imageUrl = `url(${fileToDataUri(join(bgDir, filename))})`; imageUrl = `url(${fileToDataUri(join(bgDir, filename))})`;
} catch { /* read failed */ } } catch { /* read failed */ }