Learning/mRemoteNG
1
0
Fork 0
mirror of https://github.com/mRemoteNG/mRemoteNG.git synced 2026-02-17 22:11:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2801 from mRemoteNG/fix/aikido-security-sast--7464275-6ovw

Browse Source 
[Aikido] AI Fix for Path traversal attack possible
This commit is contained in:
Dimitrij
2025-09-16 20:43:33 +01:00
committed by GitHub
parent eb535cad2c 8f35b2ef71
commit 0d460d543b
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
mRemoteNG/Themes/ThemeSerializer.cs
View File

@@ -16,6 +16,10 @@ namespace mRemoteNG.Themes
/// <param name="baseTheme"></param>
public static void SaveToXmlFile(ThemeInfo themeToSave, ThemeInfo baseTheme)
{
if (baseTheme.URI == null || baseTheme.URI.Contains("../") || baseTheme.URI.Contains(@"..\"))
throw new ArgumentException("Invalid file path");
if (themeToSave.Name == null || themeToSave.Name.Contains("../") || themeToSave.Name.Contains(@"..\"))
throw new ArgumentException("Invalid file path");
string oldURI = baseTheme.URI;
string directoryName = Path.GetDirectoryName(oldURI);
string toSaveURI = directoryName + Path.DirectorySeparatorChar + themeToSave.Name + ".vstheme";
@@ -34,6 +38,8 @@ namespace mRemoteNG.Themes
/// <param name="themeToUpdate"></param>
public static void UpdateThemeXMLValues(ThemeInfo themeToUpdate)
{
if (themeToUpdate.URI == null || themeToUpdate.URI.Contains("../") || themeToUpdate.URI.Contains(@"..\"))
throw new ArgumentException("Invalid file path");
byte[] bytesIn = File.ReadAllBytes(themeToUpdate.URI);
MremoteNGPaletteManipulator manipulator = new(bytesIn, themeToUpdate.ExtendedPalette);
byte[] bytesOut = manipulator.mergePalette(themeToUpdate.ExtendedPalette);
@@ -48,6 +54,8 @@ namespace mRemoteNG.Themes
/// <returns></returns>
public static ThemeInfo LoadFromXmlFile(string filename, ThemeInfo defaultTheme = null)
{
if (filename == null || filename.Contains("../") || filename.Contains(@"..\"))
throw new ArgumentException("Invalid file path");
byte[] bytes = File.ReadAllBytes(filename);
//Load the dockpanel part
MremoteNGThemeBase themeBaseLoad = new(bytes);