From 8d12491e322d1659413feabf597e6a52621a285a Mon Sep 17 00:00:00 2001 From: Raycoms Date: Mon, 7 Sep 2026 19:57:37 +0800 Subject: [PATCH 1/4] clean packname --- .../storage/ClientStructurePackLoader.java | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java b/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java index 32e2c7d61..a20f15e73 100644 --- a/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java +++ b/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java @@ -13,6 +13,7 @@ import com.ldtteam.structurize.util.JavaUtils; import io.netty.buffer.ByteBuf; import io.netty.buffer.ByteBufInputStream; +import net.minecraft.FileUtil; import net.minecraft.client.Minecraft; import net.minecraft.core.HolderLookup; import net.minecraft.nbt.CompoundTag; @@ -22,9 +23,11 @@ import net.neoforged.fml.ModList; import net.neoforged.neoforge.client.event.ClientTickEvent; import net.neoforged.neoforgespi.language.IModInfo; + import java.io.*; import java.nio.file.Files; import java.nio.file.Path; +import java.nio.file.Paths; import java.nio.file.StandardCopyOption; import java.util.*; import java.util.stream.Stream; @@ -260,6 +263,11 @@ else if (version != pack.getVersion()) */ public static void onStructurePackTransfer(final String packName, final ByteBuf payload, final boolean eol) { + if (!isSafePackName(packName)) + { + Log.getLogger().error("Received Structure pack with unsafe name from the Server: " + packName); + return; + } Log.getLogger().warn("Received Structure pack from the Server: " + packName); IOPool.execute(() -> { @@ -338,6 +346,21 @@ public static Path zipSlipProtect(ZipEntry zipEntry, Path targetDir) throws IOEx return normalizePath; } + private static boolean isSafePackName(final String packName) + { + if (packName == null || packName.isBlank() || packName.equals(".") || packName.equals("..")) + { + return false; + } + if (packName.contains("/") || packName.contains("\\")) + { + return false; + } + + final Path candidate = Paths.get(packName); + return FileUtil.isPathNormalized(candidate) && FileUtil.isPathPortable(candidate); + } + /** * Handles the save message of scans. * From 262621b30958f25db14c2f1c860a7b15500e07f7 Mon Sep 17 00:00:00 2001 From: Raycoms Date: Mon, 7 Sep 2026 20:12:15 +0800 Subject: [PATCH 2/4] Easier --- .../storage/ClientStructurePackLoader.java | 35 ++++++------------- 1 file changed, 11 insertions(+), 24 deletions(-) diff --git a/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java b/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java index a20f15e73..05fb9001a 100644 --- a/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java +++ b/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java @@ -263,11 +263,6 @@ else if (version != pack.getVersion()) */ public static void onStructurePackTransfer(final String packName, final ByteBuf payload, final boolean eol) { - if (!isSafePackName(packName)) - { - Log.getLogger().error("Received Structure pack with unsafe name from the Server: " + packName); - return; - } Log.getLogger().warn("Received Structure pack from the Server: " + packName); IOPool.execute(() -> { @@ -277,13 +272,20 @@ public static void onStructurePackTransfer(final String packName, final ByteBuf Log.getLogger().warn("Error trying to delete pack: "); } + final Path structureFolder = Minecraft.getInstance().gameDirectory.toPath().resolve(BLUEPRINT_FOLDER).normalize(); + final Path childPath = structureFolder.resolve(packName).normalize(); + + if (childPath.getParent() == null || !childPath.getParent().equals(structureFolder)) + { + Log.getLogger().error("Received Structure pack with unsafe name from the Server: " + packName); + return; + } + try (ZipInputStream zis = new ZipInputStream(new ByteBufInputStream(payload))) { ZipEntry zipEntry = zis.getNextEntry(); - final Path structureFolder = Minecraft.getInstance().gameDirectory.toPath().resolve(BLUEPRINT_FOLDER); - JavaUtils.deleteDirectory(structureFolder.resolve(packName)); - final Path rootPath = Files.createDirectory(structureFolder.resolve(packName)); + final Path rootPath = Files.createDirectory(structureFolder.resolve(packName)); while (zipEntry != null) { boolean isDirectory = zipEntry.isDirectory(); @@ -345,22 +347,7 @@ public static Path zipSlipProtect(ZipEntry zipEntry, Path targetDir) throws IOEx return normalizePath; } - - private static boolean isSafePackName(final String packName) - { - if (packName == null || packName.isBlank() || packName.equals(".") || packName.equals("..")) - { - return false; - } - if (packName.contains("/") || packName.contains("\\")) - { - return false; - } - - final Path candidate = Paths.get(packName); - return FileUtil.isPathNormalized(candidate) && FileUtil.isPathPortable(candidate); - } - + /** * Handles the save message of scans. * From 5886e44ec1b5797ff4b3667d2c7defbc6342076f Mon Sep 17 00:00:00 2001 From: Raycoms Date: Mon, 7 Sep 2026 20:12:29 +0800 Subject: [PATCH 3/4] cleanup --- .../structurize/storage/ClientStructurePackLoader.java | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java b/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java index 05fb9001a..b15b9a4cb 100644 --- a/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java +++ b/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java @@ -13,7 +13,6 @@ import com.ldtteam.structurize.util.JavaUtils; import io.netty.buffer.ByteBuf; import io.netty.buffer.ByteBufInputStream; -import net.minecraft.FileUtil; import net.minecraft.client.Minecraft; import net.minecraft.core.HolderLookup; import net.minecraft.nbt.CompoundTag; @@ -27,7 +26,6 @@ import java.io.*; import java.nio.file.Files; import java.nio.file.Path; -import java.nio.file.Paths; import java.nio.file.StandardCopyOption; import java.util.*; import java.util.stream.Stream; @@ -347,7 +345,7 @@ public static Path zipSlipProtect(ZipEntry zipEntry, Path targetDir) throws IOEx return normalizePath; } - + /** * Handles the save message of scans. * From 6547b38778d668a83263c57fff7baf0fc33bd3cf Mon Sep 17 00:00:00 2001 From: Raycoms Date: Mon, 7 Sep 2026 20:31:25 +0800 Subject: [PATCH 4/4] fixes --- .../java/com/ldtteam/structurize/api/Utils.java | 5 +++++ .../storage/ClientStructurePackLoader.java | 15 ++++++++------- 2 files changed, 13 insertions(+), 7 deletions(-) diff --git a/src/main/java/com/ldtteam/structurize/api/Utils.java b/src/main/java/com/ldtteam/structurize/api/Utils.java index b653f0525..5db26f2ab 100644 --- a/src/main/java/com/ldtteam/structurize/api/Utils.java +++ b/src/main/java/com/ldtteam/structurize/api/Utils.java @@ -90,6 +90,11 @@ public static String getSafePackName(String input) s = s.replaceAll("[\\\\/:*?\"<>|]", "_"); s = s.replaceAll("\\p{Cntrl}", ""); s = s.trim(); + if (s.isEmpty() || s.equals(".") || s.equals("..") || s.length() > 255) + { + return ""; + } + return s; } } diff --git a/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java b/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java index b15b9a4cb..d48365d01 100644 --- a/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java +++ b/src/main/java/com/ldtteam/structurize/storage/ClientStructurePackLoader.java @@ -255,12 +255,13 @@ else if (version != pack.getVersion()) /** * On reception of a new structure pack. * - * @param packName the name of the structure pack. + * @param name the name of the structure pack. * @param payload the payload of the pack. * @param eol if last sync. */ - public static void onStructurePackTransfer(final String packName, final ByteBuf payload, final boolean eol) + public static void onStructurePackTransfer(final String name, final ByteBuf payload, final boolean eol) { + final String packName = Utils.getSafePackName(name); Log.getLogger().warn("Received Structure pack from the Server: " + packName); IOPool.execute(() -> { @@ -271,19 +272,19 @@ public static void onStructurePackTransfer(final String packName, final ByteBuf } final Path structureFolder = Minecraft.getInstance().gameDirectory.toPath().resolve(BLUEPRINT_FOLDER).normalize(); - final Path childPath = structureFolder.resolve(packName).normalize(); - - if (childPath.getParent() == null || !childPath.getParent().equals(structureFolder)) + final Path childPath = structureFolder.resolve(packName); + if (Files.isSymbolicLink(childPath)) { - Log.getLogger().error("Received Structure pack with unsafe name from the Server: " + packName); return; } + JavaUtils.deleteDirectory(childPath); + try (ZipInputStream zis = new ZipInputStream(new ByteBufInputStream(payload))) { ZipEntry zipEntry = zis.getNextEntry(); - final Path rootPath = Files.createDirectory(structureFolder.resolve(packName)); + final Path rootPath = Files.createDirectory(childPath); while (zipEntry != null) { boolean isDirectory = zipEntry.isDirectory();