snxrzx/mkxp-sunshine
1
0
Fork 0
mirror of https://forgejo.xatacraft.ru/Sunshine/mkxp-sunshine.git synced 2026-08-19 21:39:57 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fixed code execution with translations vulnerability :3

Browse source 
now unescaping strings with own method
This commit is contained in:
wixetech 2026-05-31 07:36:48 -07:00 committed by GitHub
parent c5589bff11
commit 1e47bce1c4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 43 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

47
scripts/i18n_Language.rb
View file

@ -29,6 +29,45 @@ class Language
reset_fonts(@text_sprites)
Oneshot.set_yes_no(tr('Yes'), tr('No'))
end
def unescape_string(str)
unescaped = []
string_began = false
escape = false
str.chars.each do |c|
if not string_began
string_began = true if c == '"'
next
end
next if c == "\n"
next if c == "\r"
if not escape
break if c == '"'
if c == '\\'
escape = true
next
end
else
escape = false
case c
when 'n'
unescaped.push("\n")
when 'r'
unescaped.push("\r")
else
unescaped.push(c)
end
next
end
unescaped.push(c)
end
return unescaped.join('')
end
def load_pot(path)
msgid = nil
@ -42,25 +81,25 @@ class Language
line = line[6..-1]
#unescape the string
#note that I tried using undump here instead before, but it doesn't play nicely with non-ascii characters
eval("msgid = " + line)
msgid = unescape_string(line)
lastLineWasMsgId = true
lastLineWasMsgStr = false
elsif line.start_with?("msgstr ")
line = line[7..-1]
#unescape the string
eval("msgstr = " + line)
msgstr = unescape_string(line)
lastLineWasMsgId = false
lastLineWasMsgStr = true
elsif line.start_with?("\"")
if lastLineWasMsgId
eval("msgid += " + line)
msgid += unescape_string(line)
lastLineWasMsgId = true
lastLineWasMsgStr = false
elsif lastLineWasMsgStr
eval("msgstr += " + line)
msgstr += unescape_string(line)
lastLineWasMsgId = false
lastLineWasMsgStr = true