mirror of
https://github.com/Kelsidavis/WoWee.git
synced 2026-05-07 01:23:52 +00:00
c05d421c29
Three security/robustness guards on unpackZone:
1. fileCount > 1M or infoSize > 16MB rejected upfront — would OOM on
the next allocation.
2. Per-file dataSize > 256MB rejected — single malicious entry could
exhaust memory mid-extraction.
3. Path traversal ('..' or absolute paths) rejected — would write
outside destDir/<zoneName>/ and clobber system files.
WCPs are user-shareable archives, so a hostile pack downloaded from a
forum should not be able to OOM the editor or write to /etc.
|
||
|---|---|---|
| .. | ||
| asset_extract | ||
| auth_login_probe | ||
| auth_probe | ||
| blp_convert | ||
| dbc_to_csv | ||
| editor | ||
| asset_pipeline_gui.py | ||
| backup_assets.sh | ||
| diff_classic_turtle_opcodes.py | ||
| gen_opcode_registry.py | ||
| generate_ffx_sdk_vk_permutations.sh | ||
| m2_viewer.py | ||
| opcode_map_utils.py | ||
| validate_opcode_maps.py | ||