From 7198dec355144fbb0eaccb39f0c241dd07ebaee0 Mon Sep 17 00:00:00 2001 From: Florent Rougon Date: Tue, 6 Oct 2015 12:20:54 +0200 Subject: [PATCH] Use SGPath::realpath() on the value supplied for --aircraft-dir * Before setting /sim/aircraft-dir from the --aircraft-dir option, canonicalize its value with SGPath::realpath() as is already done in FGGlobals::append_aircraft_path() for the paths given with --fg-aircraft or via the FG_AIRCRAFT environment variable. * This fixes a bug when --aircraft-dir is used, due to the fact that fgValidatePath() canonicalizes its 'path' argument before matching it against the allowed patterns, and therefore will not validate paths under the directory specified with --aircraft-dir if this directory has been given in a non-canonical form by the user (e.g., containing at least one symlink component). * This fix does not lower security: the path which is canonicalized has been explicitely given by the user. This operation is already done for all paths specified with --fg-aircraft or via the FG_AIRCRAFT environment variable, via Options::initPaths() which calls FGGlobals::append_aircraft_paths(). * To reproduce the bug, create a symlink (e.g., /tmp/aircrafts) to a directory suitable for --fg-aircraft, then run: fgfs ... --fg-aircraft=/tmp/aircrafts \ --aircraft-dir=/tmp/aircrafts/SenecaII --aircraft=SenecaII This will trigger many failures such as: loadxml: reading '/tmp/aircrafts/SenecaII/Dialogs/registration.xml' denied (unauthorized directory - authorization no longer follows symlinks; to authorize reading additional directories, add them to --fg-aircraft) (from do_load_xml_to_proptree() in flightgear/src/Main/fg_commands.cxx) I have also tested this with the ec130b4 and the 777-200ER. Same problem, same fix. --- src/Main/options.cxx | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/Main/options.cxx b/src/Main/options.cxx index 937e0071a..a27ecb382 100644 --- a/src/Main/options.cxx +++ b/src/Main/options.cxx @@ -2024,8 +2024,15 @@ void Options::initAircraft() } if (isOptionSet("aircraft-dir")) { - // set this now, so it's available in FindAndCacheAircraft - fgSetString("/sim/aircraft-dir", valueForOption("aircraft-dir")); + SGPath aircraftDirPath(valueForOption("aircraft-dir")); + + // Set this now, so it's available in FindAndCacheAircraft. Use realpath() + // as in FGGlobals::append_aircraft_path(), otherwise fgValidatePath() + // will deny access to resources under this path if one of its components + // is a symlink (which is not a problem, since it was given as is by the + // user---this is very different from a symlink *under* the aircraft dir + // or a scenery dir). + fgSetString("/sim/aircraft-dir", aircraftDirPath.realpath().c_str()); } } -- 2.39.5