From 0ec47c9802bb82560c0c11768cc61bae7bfc29c3 Mon Sep 17 00:00:00 2001 From: "Rebecca N. Palmer" <rebecca_palmer@zoho.com> Date: Tue, 18 Oct 2016 22:35:10 +0100 Subject: [PATCH] Simplify Nasal security code --- src/Main/globals.cxx | 1 + src/Main/globals.hxx | 8 +++++++- src/Main/util.cxx | 7 +------ 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/src/Main/globals.cxx b/src/Main/globals.cxx index 8446a4573..ecbf5ffab 100644 --- a/src/Main/globals.cxx +++ b/src/Main/globals.cxx @@ -472,6 +472,7 @@ void FGGlobals::append_aircraft_path(const SGPath& path) } fg_aircraft_dirs.push_back(dirPath.realpath()); + extra_read_allowed_paths.push_back(dirPath.realpath()); } void FGGlobals::append_aircraft_paths(const PathList& paths) diff --git a/src/Main/globals.hxx b/src/Main/globals.hxx index eec8128ae..104d288d9 100644 --- a/src/Main/globals.hxx +++ b/src/Main/globals.hxx @@ -258,7 +258,13 @@ public: void set_catalog_aircraft_path(const SGPath& path); PathList get_aircraft_paths() const; - + /** + * Add an aircraft directory + * + * This also makes the path Nasal-readable: + * to avoid can-read-any-file security holes, do NOT call this on paths + * obtained from the property tree or other Nasal-writable places + */ void append_aircraft_path(const SGPath& path); void append_aircraft_paths(const PathList& path); diff --git a/src/Main/util.cxx b/src/Main/util.cxx index 8ef85b551..fb0a1668e 100644 --- a/src/Main/util.cxx +++ b/src/Main/util.cxx @@ -93,12 +93,7 @@ void fgInitAllowedPaths() read_allowed_paths.clear(); write_allowed_paths.clear(); - const PathList& aircraft_paths = globals->get_aircraft_paths(); - const PathList& other_read_paths = globals->get_extra_read_allowed_paths(); - // not plain fg_scenery, to avoid making - // /sim/terrasync/scenery-dir a security hole - PathList read_paths = aircraft_paths; - read_paths.insert(read_paths.end(), other_read_paths.begin(), other_read_paths.end()); + PathList read_paths = globals->get_extra_read_allowed_paths(); read_paths.push_back(globals->get_fg_root()); read_paths.push_back(globals->get_fg_home());