Treat backslash as a path separator in XModem filename validation (#11085)

This commit is contained in:
Thomas Göttgens
2026-07-20 10:46:33 +02:00
committed by GitHub
co-authored by GitHub
parent 19ddadf3ff
commit ba8b1b1038
2 changed files with 25 additions and 1 deletions
+4 -1
View File
@@ -62,10 +62,13 @@ bool XModemAdapter::isValidFilename(const char *name)
{
if (!name || name[0] == '\0')
return false;
const bool driveLetter = (name[0] >= 'A' && name[0] <= 'Z') || (name[0] >= 'a' && name[0] <= 'z');
if (driveLetter && name[1] == ':')
return false;
// Reject any ".." path component. Absolute paths and subdirectories are fine; they stay within
// the filesystem root, so only traversal out of it needs blocking.
for (const char *seg = name; *seg;) {
const char *slash = strchr(seg, '/');
const char *slash = strpbrk(seg, "/\\");
const size_t len = slash ? (size_t)(slash - seg) : strlen(seg);
if (len == 2 && seg[0] == '.' && seg[1] == '.')
return false;