From a705b7cf952c5d91bdf87542068a109f02e1c33b Mon Sep 17 00:00:00 2001 From: Zkitefly <64117916+zkitefly@users.noreply.github.com> Date: Wed, 13 Aug 2025 16:03:53 +0800 Subject: [PATCH] =?UTF-8?q?Fix=203955:=20=E5=90=AF=E5=8A=A8=E6=97=B6?= =?UTF-8?q?=E4=B8=8D=E5=BA=94=E8=A1=A5=E5=85=A8=E6=9C=8D=E5=8A=A1=E7=AB=AF?= =?UTF-8?q?=E8=87=AA=E5=8A=A8=E6=9B=B4=E6=96=B0=E6=95=B4=E5=90=88=E5=8C=85?= =?UTF-8?q?=E4=B8=AD=E5=B7=B2=E7=A6=81=E7=94=A8=E7=9A=84=20mod=20(#3956)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Glavo --- .../server/ServerModpackCompletionTask.java | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/HMCLCore/src/main/java/org/jackhuang/hmcl/mod/server/ServerModpackCompletionTask.java b/HMCLCore/src/main/java/org/jackhuang/hmcl/mod/server/ServerModpackCompletionTask.java index 5edc37760..4b3e094ab 100644 --- a/HMCLCore/src/main/java/org/jackhuang/hmcl/mod/server/ServerModpackCompletionTask.java +++ b/HMCLCore/src/main/java/org/jackhuang/hmcl/mod/server/ServerModpackCompletionTask.java @@ -21,6 +21,7 @@ import com.google.gson.JsonParseException; import org.jackhuang.hmcl.download.DefaultDependencyManager; import org.jackhuang.hmcl.download.GameBuilder; import org.jackhuang.hmcl.game.DefaultGameRepository; +import org.jackhuang.hmcl.mod.ModManager; import org.jackhuang.hmcl.mod.ModpackConfiguration; import org.jackhuang.hmcl.task.FileDownloadTask; import org.jackhuang.hmcl.task.GetTask; @@ -120,7 +121,7 @@ public class ServerModpackCompletionTask extends Task { dependencies.add(builder.buildAsync()); } - Path rootPath = repository.getVersionRoot(version).toPath(); + Path rootPath = repository.getVersionRoot(version).toPath().toAbsolutePath().normalize(); Map files = manifest.getManifest().getFiles().stream() .collect(Collectors.toMap(ModpackConfiguration.FileInformation::getPath, Function.identity())); @@ -128,12 +129,24 @@ public class ServerModpackCompletionTask extends Task { Set remoteFiles = remoteManifest.getFiles().stream().map(ModpackConfiguration.FileInformation::getPath) .collect(Collectors.toSet()); + Path runDirectory = repository.getRunDirectory(version).toPath().toAbsolutePath().normalize(); + Path modsDirectory = runDirectory.resolve("mods"); + int total = 0; // for files in new modpack for (ModpackConfiguration.FileInformation file : remoteManifest.getFiles()) { - Path actualPath = rootPath.resolve(file.getPath()); + Path actualPath = rootPath.resolve(file.getPath()).toAbsolutePath().normalize(); + String fileName = actualPath.getFileName().toString(); + + if (!actualPath.startsWith(rootPath)) { + throw new IOException("Unsecure path: " + file.getPath()); + } + boolean download; - if (!files.containsKey(file.getPath())) { + if (!files.containsKey(file.getPath()) || + modsDirectory.equals(actualPath.getParent()) + && Files.notExists(actualPath.resolveSibling(fileName + ModManager.DISABLED_EXTENSION)) + && Files.notExists(actualPath.resolveSibling(fileName + ModManager.OLD_EXTENSION))) { // If old modpack does not have this entry, download it download = true; } else if (!Files.exists(actualPath)) {