Merge pull request #229 from lexize/file_api_fix

Quick fix of FileAPI so it always uses actual path
FiguraMC · Jun 22, 2024 · bb6edda · bb6edda
2 parents 35d1b59 + 7141071
commit bb6edda
Showing 1 changed file with 11 additions and 8 deletions.
diff --git a/common/src/main/java/org/figuramc/figura/lua/api/FileAPI.java b/common/src/main/java/org/figuramc/figura/lua/api/FileAPI.java
@@ -25,8 +25,6 @@
 @LuaTypeDoc(name = "FileAPI", value = "file")
 public class FileAPI {
     private final Avatar parent;
-    private static final Path rootFolderPath = FiguraMod.getFiguraDirectory().resolve("data").toAbsolutePath()
-            .normalize();
     private static final String WRITE_NOT_ALLOWED = "You are only allowed to write in the data folder! Anything else is read only!";
 
     public FileAPI(Avatar parent) {
@@ -41,10 +39,15 @@ private Path securityCheck(String path) {
         return p;
     }
 
+    private static Path dataPath() {
+        return FiguraMod.getFiguraDirectory().resolve("data").toAbsolutePath()
+                .normalize();
+    }
+
     private Path relativizePath(String path) {
         Path p = Path.of(path);
         if (p.isAbsolute()) return p.normalize();
-        return rootFolderPath.resolve(path).toAbsolutePath().normalize();
+        return dataPath().resolve(path).toAbsolutePath().normalize();
     }
 
     @LuaWhitelist
@@ -61,7 +64,7 @@ public boolean isPathAllowed(@LuaNotNil String path) {
     }
 
     public boolean isPathAllowed(Path path) {
-        return !Files.isSymbolicLink(path) && path.toAbsolutePath().startsWith(rootFolderPath);
+        return !Files.isSymbolicLink(path) && path.toAbsolutePath().startsWith(dataPath());
     }
 
     @LuaWhitelist
@@ -152,7 +155,7 @@ public FiguraInputStream openReadStream(@LuaNotNil String path) {
     public FiguraOutputStream openWriteStream(@LuaNotNil String path) {
         try {
             Path p = securityCheck(path);
-            if (!p.startsWith(rootFolderPath)) {
+            if (!p.startsWith(dataPath())) {
                 throw new LuaError(WRITE_NOT_ALLOWED);
             }
             File f = p.toFile();
@@ -226,7 +229,7 @@ public void writeString(@LuaNotNil String path, @LuaNotNil String data, String e
     )
     public boolean mkdir(@LuaNotNil String path) {
         Path p = securityCheck(path);
-        if (!p.startsWith(rootFolderPath)) {
+        if (!p.startsWith(dataPath())) {
             throw new LuaError(WRITE_NOT_ALLOWED);
         }
         File f = p.toFile();
@@ -244,7 +247,7 @@ public boolean mkdir(@LuaNotNil String path) {
     )
     public boolean mkdirs(@LuaNotNil String path) {
         Path p = securityCheck(path);
-        if (!p.startsWith(rootFolderPath)) {
+        if (!p.startsWith(dataPath())) {
             throw new LuaError(WRITE_NOT_ALLOWED);
         }
         File f = p.toFile();
@@ -262,7 +265,7 @@ public boolean mkdirs(@LuaNotNil String path) {
     )
     public boolean delete(@LuaNotNil String path) {
         Path p = securityCheck(path);
-        if (!p.startsWith(rootFolderPath)) {
+        if (!p.startsWith(dataPath())) {
             throw new LuaError(WRITE_NOT_ALLOWED);
         }
         File f = p.toFile();