head	1.2;
access;
symbols
	pkgsrc-2013Q2:1.2.0.8
	pkgsrc-2013Q2-base:1.2
	pkgsrc-2012Q4:1.2.0.6
	pkgsrc-2012Q4-base:1.2
	pkgsrc-2011Q4:1.2.0.4
	pkgsrc-2011Q4-base:1.2
	pkgsrc-2011Q2:1.2.0.2
	pkgsrc-2011Q2-base:1.2;
locks; strict;
comment	@# @;


1.2
date	2010.06.02.10.14.15;	author markd;	state dead;
branches;
next	1.1;

1.1
date	2010.05.16.21.21.39;	author markd;	state Exp;
branches;
next	;


desc
@@


1.2
log
@Update to KDE SC 4.4.4

* Several bugs in filename sorting in the Dolphin file manager have been
  fixed
* Issues with encoded filenames in ZIP archives have been fixed
* A number of bugs in games, such as KMines, KNetwalk and LSkat and
  KSpaceDuel have been fixed
The changelog lists more
@
text
@$NetBSD: patch-bd,v 1.1 2010/05/16 21:21:39 markd Exp $

--- kget/ui/metalinkcreator/metalinker.cpp.orig	2010-01-31 19:33:11.000000000 +0000
+++ kget/ui/metalinkcreator/metalinker.cpp
@@@@ -528,14 +528,14 @@@@ void KGetMetalink::Verification::clear()
 
 bool KGetMetalink::File::isValid() const
 {
-    return !name.isEmpty() && resources.isValid();
+    return isValidNameAttribute() && resources.isValid();
 }
 
 void KGetMetalink::File::load(const QDomElement &e)
 {
     data.load(e);
 
-    name = e.attribute("name");
+    name = QUrl::fromPercentEncoding(e.attribute("name").toAscii());
     size = e.firstChildElement("size").text().toULongLong();
 
     verification.load(e);
@@@@ -575,6 +575,22 @@@@ void KGetMetalink::File::clear()
     resources.clear();
 }
 
+
+bool KGetMetalink::File::isValidNameAttribute() const
+{
+    if (name.isEmpty()) {
+        kError(5001) << "Name attribute of Metalink::File is empty.";
+        return false;
+    }
+
+    if (name.contains(QRegExp("$(\\.\\.?)?/")) || name.contains("/../") || name.endsWith("/..")) {
+        kError(5001) << "Name attribute of Metalink::File contains directory traversal directives:" << name;
+        return false;
+    }
+
+    return true;
+}
+
 #ifdef HAVE_NEPOMUK
 QHash<QUrl, Nepomuk::Variant> KGetMetalink::File::properties() const
 {
@@@@ -584,13 +600,28 @@@@ QHash<QUrl, Nepomuk::Variant> KGetMetali
 
 bool KGetMetalink::Files::isValid() const
 {
-    bool isValid = !files.empty();
-    foreach (const File &file, files)
-    {
-        isValid &= file.isValid();
+    if (files.isEmpty()) {
+        return false;
+    }
+
+    QStringList fileNames;
+    foreach (const File &file, files) {
+        fileNames << file.name;
+        if (!file.isValid()) {
+            return false;
+        }
     }
 
-    return isValid;
+    //The value of name must be unique for each file
+    while (!fileNames.isEmpty()) {
+        const QString fileName = fileNames.takeFirst();
+        if (fileNames.contains(fileName)) {
+            kError(5001) << "Metalink::File name" << fileName << "exists multiple times.";
+            return false;
+        }
+    }
+
+    return true;
 }
 
 void KGetMetalink::Files::load(const QDomElement &e)
@@@@ -751,7 +782,7 @@@@ void KGetMetalink::Metalink_v3::parseFil
 
     for (QDomElement elem = filesElem.firstChildElement("file"); !elem.isNull(); elem = elem.nextSiblingElement("file")) {
         File file;
-        file.name = elem.attribute("name");
+        file.name = QUrl::fromPercentEncoding(elem.attribute("name").toAscii());
         file.size = elem.firstChildElement("size").text().toULongLong();
 
         file.data = parseCommonData(elem);
@


1.1
log
@Fix from KDE security advisory 20100513-1.
@
text
@d1 1
a1 1
$NetBSD$
@