Skip to content

fix: apply traversal-safe path normalization to direct-fetch asset fallback #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Smeagol1907 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: apply traversal-safe path normalization to direct-fetch asset fallback #5

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion src/lib/mujoco-asset-loader.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,14 @@ export async function loadMuJoCoAssets(
}

// Create necessary directories and load each asset
for (const assetPath of uniqueAssets) {
for (const rawAssetPath of uniqueAssets) {
// Normalize the path exactly as buildZipCandidates does for the zip lookup,
// so a "../" sequence embedded in the task XML's file="..." attribute can't
// escape the intended assets directory when we fall back to a direct fetch.
// Without this, the zip-lookup path was traversal-safe but this fallback
// path used the raw, unsanitized string straight from the XML.
const assetPath = normalizeZipPath(rawAssetPath);

// Strip directory prefix from API path (backend already knows this directory)
// But keep it for VFS path (MuJoCo needs the full path as specified in XML)
let apiPath = assetPath;
Expand Down