Skip to content

Conversation

@bobtista
Copy link

@bobtista bobtista commented Nov 7, 2025

Implements file content validation during map transfer operations to prevent malformed or malicious files from being processed.

Implementation

Adds FileSystem::hasValidTransferFileContent() which validates transferred files after they are written to disk but before the transfer is marked complete. If validation fails, the file is automatically deleted.

Validation methods:

  • .map files - Validates magic bytes CkMp (Chunky Map header)
  • .ini files - Checks for null bytes to ensure text format (rejects binary)
  • .tga files - Validates minimum size (18 bytes for valid TGA header)
  • .str, .txt, .wak - Size validation only

Maximum file sizes:

  • .map: 50 MB
  • .ini: 10 MB
  • .str/.txt: 5 MB
  • .tga: 20 MB
  • .wak: 10 MB

@bobtista bobtista force-pushed the bobtista/security-content-validation branch from 630dbcb to 218f4b9 Compare November 7, 2025 05:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Map transfers lack file content validation

1 participant