From 9dea3ba0887017aaf37a5da45f56fdefe6c27379 Mon Sep 17 00:00:00 2001 From: Cyberboss Date: Tue, 23 Oct 2018 16:25:21 -0400 Subject: [PATCH] Prevent instances from being created in the installation directory --- .../Controllers/InstanceController.cs | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/Tgstation.Server.Host/Controllers/InstanceController.cs b/src/Tgstation.Server.Host/Controllers/InstanceController.cs index 8a4cb807e1..e220a74e39 100644 --- a/src/Tgstation.Server.Host/Controllers/InstanceController.cs +++ b/src/Tgstation.Server.Host/Controllers/InstanceController.cs @@ -120,6 +120,17 @@ namespace Tgstation.Server.Host.Controllers return BadRequest(new ErrorMessage { Message = "path must not be empty!" }); NormalizeModelPath(model, out var rawPath); + + var localPath = ioManager.ResolvePath("."); + NormalizeModelPath(new Api.Models.Instance + { + Path = localPath + }, out var normalizedLocalPath); + + if (rawPath.StartsWith(normalizedLocalPath, StringComparison.Ordinal)) + return Conflict("Instances cannot be created in the installation directory!"); + + var dirExistsTask = ioManager.DirectoryExists(model.Path, cancellationToken); bool attached = false; if (await ioManager.FileExists(model.Path, cancellationToken).ConfigureAwait(false) || await dirExistsTask.ConfigureAwait(false))