Nasal security: make directory() use fgValidatePath

Being able to list arbitrary directories is a privacy violation;
existing in-fgdata uses of this are all permitted paths
(i.e. not Terrasync; FileSelector doesn't use it)

diff --git a/src/Scripting/NasalSys.cxx b/src/Scripting/NasalSys.cxx
index 1a320d567682c0f6dcdcf0a8a5fdfa5db4edd6a7..dcd996540d68d1cdcabf9bf8be4c9cb5000a56f1 100644 (file)
--- a/src/Scripting/NasalSys.cxx
+++ b/src/Scripting/NasalSys.cxx
@@ -574,8 +574,19 @@ static naRef f_directory(naContext c, naRef me, int argc, naRef* args)
 {
     if(argc != 1 || !naIsString(args[0]))
         naRuntimeError(c, "bad arguments to directory()");
-    
-    simgear::Dir d(SGPath(naStr_data(args[0])));
+
+    std::string dirname = fgValidatePath(naStr_data(args[0]), false);
+    if(dirname.empty()) {
+        SG_LOG(SG_NASAL, SG_ALERT, "directory(): listing '" <<
+        naStr_data(args[0]) << "' denied (unauthorized directory - authorization"
+        " no longer follows symlinks; to authorize reading additional "
+        "directories, add them to --fg-aircraft)");
+        naRuntimeError(c, "directory(): access denied (unauthorized directory)");
+        return naNil();
+    }
+
+    SGPath d0(dirname);
+    simgear::Dir d(d0);
     if(!d.exists()) return naNil();
     naRef result = naNewVector(c);