Fix security, bugs, and UX in asset pipeline GUI

- Fix zip slip vulnerability: validate extracted paths stay within target
- Fix redundant mkdir before rmtree in rebuild_override()
- Add build/asset_extract and Windows .ps1 fallback to extractor search
- Preserve pack list selection across refreshes
- Add Cancel Extraction button with process.terminate()
- Run override rebuild in background thread to avoid UI freeze
- Fix locale combobox state to readonly
- Add asset_pipeline/ to .gitignore
- Make script executable
This commit is contained in:
Kelsi 2026-02-23 20:06:41 -08:00
parent 20dd5ed63b
commit f95770720f
2 changed files with 52 additions and 18 deletions

3
.gitignore vendored
View file

@ -89,6 +89,9 @@ Data/expansions/*/overlay/
Data/hd/
ingest/
# Asset pipeline state and texture packs
asset_pipeline/
# Local texture dumps / extracted art should never be committed
assets/textures/
node_modules/