From f62d827fbfb39aa5bf552d0beb13b9161a4558d2 Mon Sep 17 00:00:00 2001 From: Jordan Brown Date: Wed, 22 Apr 2020 13:09:44 -0400 Subject: [PATCH] Only trust the .dmb in trusted mode --- .../Components/Watchdog/SessionControllerFactory.cs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/Tgstation.Server.Host/Components/Watchdog/SessionControllerFactory.cs b/src/Tgstation.Server.Host/Components/Watchdog/SessionControllerFactory.cs index 81d510e76d..65ab08c11e 100644 --- a/src/Tgstation.Server.Host/Components/Watchdog/SessionControllerFactory.cs +++ b/src/Tgstation.Server.Host/Components/Watchdog/SessionControllerFactory.cs @@ -236,7 +236,8 @@ namespace Tgstation.Server.Host.Components.Watchdog var byondLock = currentByondLock ?? await byond.UseExecutables(Version.Parse(dmbProvider.CompileJob.ByondVersion), cancellationToken).ConfigureAwait(false); try { - await byondLock.TrustDmbPath(ioManager.ConcatPath(basePath, dmbProvider.DmbName), cancellationToken).ConfigureAwait(false); + if (securityLevelToUse == DreamDaemonSecurity.Trusted) + await byondLock.TrustDmbPath(ioManager.ConcatPath(basePath, dmbProvider.DmbName), cancellationToken).ConfigureAwait(false); // set command line options // more sanitization here cause it uses the same scheme