v2.8.3-luajit: Merge remote-tracking branch 'origin/master' into luajit

.github/workflows/main.yml

@@ -110,7 +110,7 @@ jobs:
     - name: Download ROM & CC:T
       run: |
         sudo git clone https://github.com/MCJack123/craftos2-rom /usr/local/share/craftos
-        git clone --branch v1.20.1-1.110.2 https://github.com/cc-tweaked/CC-Tweaked ../CC-Tweaked
+        git clone --branch v1.20.1-1.112.0 https://github.com/cc-tweaked/CC-Tweaked ../CC-Tweaked
         patch -p1 -d ../CC-Tweaked < resources/CCT-Tests.patch
     - name: Install dependencies
       run: |

SECURITY.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+## Supported Versions
+
+There is only one branch for updates, so only the latest versions have security updates.
+
+## Reporting a Vulnerability
+
+If a bug is related to the following issues:
+- Filesystem sandbox escape (outside of mounts)
+- Process/library loading
+- Arbitrary code execution
+- Network rule bypass
+- Any other form of reading host information (excluding LuaJIT)
+
+it is a security vulnerability, and should be reported as such.
+
+Use the Security tab to privately report a vulnerability. It will be reviewed, and if it's valid, a patch will be made available within a week (depending on the severity of the vulnerability).

resources/CraftOS-PC.exe.manifest

@@ -3,7 +3,7 @@
     <assemblyIdentity
       type="win32"
       name="CraftOS-PC Accelerated"
-      version="2.8.2.0"
+      version="2.8.3.0"
       processorArchitecture="*"
     />
   <description>Advanced ComputerCraft Emulator</description>

resources/Info.plist

@@ -21,13 +21,13 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>2.8.2</string>
+	<string>2.8.3</string>
 	<key>CFBundleSignature</key>
 	<string>????</string>
 	<key>LSApplicationCategoryType</key>
 	<string>Unknown</string>
 	<key>CFBundleVersion</key>
-	<string>2.8.2</string>
+	<string>2.8.3</string>
 	<key>NSHumanReadableCopyright</key>
 	<string>Copyright (C) 2019-2024 JackMacWindows.</string>
 	<key>NSHighResolutionCapable</key>

src/apis/fs.cpp

@@ -67,8 +67,9 @@ inline bool isVFSPath(path_t path) {
     return false;
 }
 
-static std::vector<path_t> fixpath_multiple(Computer *comp, const std::string& path) {
+static std::vector<path_t> fixpath_multiple(Computer *comp, std::string path) {
     std::vector<path_t> retval;
+    path.erase(std::remove_if(path.begin(), path.end(), [](char c)->bool {return c == '"' || c == '*' || c == ':' || c == '<' || c == '>' || c == '?' || c == '|' || c < 32; }), path.end());
     std::vector<std::string> elems = split(path, "/\\");
     std::list<std::string> pathc;
     for (std::string s : elems) {
@@ -77,7 +78,6 @@ static std::vector<path_t> fixpath_multiple(Computer *comp, const std::string& p
             else if (pathc.empty()) pathc.push_back("..");
             else pathc.pop_back();
         } else if (!s.empty() && !std::all_of(s.begin(), s.end(), [](const char c)->bool{return c == '.';})) {
-            s.erase(std::remove_if(s.begin(), s.end(), [](char c)->bool{return c=='"'||c==':'||c=='<'||c=='>'||c=='?'||c=='|';}), s.end());
             pathc.push_back(s);
         }
     }
@@ -172,7 +172,7 @@ static int fs_list(lua_State *L) {
                 gotdir = true;
                 for (const auto& dir : fs::directory_iterator(path, e)) {
                     if (dir.path().filename() == ".DS_Store" || dir.path().filename() == "desktop.ini") continue;
-                    entries.insert(dir.path().filename().string());
+                    entries.insert(dir.path().filename().u8string());
                 }
             }
         }
@@ -296,7 +296,7 @@ static int calculateDirectorySize(const path_t& path) {
     std::error_code e;
     for (const auto& dir : fs::directory_iterator(path, e)) {
         if (dir.is_directory()) size += calculateDirectorySize(dir.path());
-        else size += dir.file_size();
+        else size += dir.file_size(e);
     }
     return size;
 }
@@ -644,7 +644,7 @@ static std::list<std::string> matchWildcard(Computer * comp, const std::list<std
                 if (fs::is_directory(path, e)) {
                     for (const auto& dir : fs::directory_iterator(path, e)) {
                         if (dir.path().filename() == ".DS_Store" || dir.path().filename() == "desktop.ini") continue;
-                        if (std::regex_match(dir.path().filename().string(), std::regex(pathc_regex))) nextOptions.push_back(opt + (opt.empty() ? "" : "/") + dir.path().filename().string());
+                        if (std::regex_match(dir.path().filename().u8string(), std::regex(pathc_regex))) nextOptions.push_back(opt + (opt.empty() ? "" : "/") + dir.path().filename().u8string());
                     }
                 }
             }

src/apis/handles/fs_handle.cpp

@@ -96,7 +96,7 @@ int fs_handle_readLine(lua_State *L) {
     std::iostream * fp = *(std::iostream**)lua_touserdata(L, lua_upvalueindex(1));
     if (fp == NULL) return luaL_error(L, "attempt to use a closed file");
     if (fp->eof()) return 0;
-    if (!fp->good()) luaL_error(L, "Could not read file");
+    if (!fp->good()) return luaL_error(L, "Could not read file");
     std::string retval;
     std::getline(*fp, retval);
     if (retval.empty() && fp->eof()) return 0;
@@ -139,7 +139,7 @@ int fs_handle_readByte(lua_State *L) {
     std::iostream * fp = *(std::iostream**)lua_touserdata(L, lua_upvalueindex(1));
     if (fp == NULL) return luaL_error(L, "attempt to use a closed file");
     if (fp->eof()) return 0;
-    if (!fp->good()) luaL_error(L, "Could not read file");
+    if (!fp->good()) return luaL_error(L, "Could not read file");
     if (lua_isnumber(L, 1)) {
         if (lua_tointeger(L, 1) < 0) luaL_error(L, "Cannot read a negative number of bytes");
         const size_t s = lua_tointeger(L, 1);
@@ -167,7 +167,7 @@ int fs_handle_readAllByte(lua_State *L) {
     std::iostream * fp = *(std::iostream**)lua_touserdata(L, lua_upvalueindex(1));
     if (fp == NULL) return luaL_error(L, "attempt to use a closed file");
     if (fp->eof()) return 0;
-    if (!fp->good()) luaL_error(L, "Could not read file");
+    if (!fp->good()) return luaL_error(L, "Could not read file");
     std::streampos pos = fp->tellg();
     fp->seekg(0, std::ios_base::end);
     size_t size = fp->tellg() - pos;
@@ -176,6 +176,7 @@ int fs_handle_readAllByte(lua_State *L) {
     if (str == NULL) return luaL_error(L, "failed to allocate memory");
     fp->read(str, size);
     size = fp->gcount();
+    fp->setstate(std::ios::eofbit); // set EOF flag
     lua_pushlstring(L, str, size);
     free(str);
     return 1;
@@ -184,10 +185,14 @@ int fs_handle_readAllByte(lua_State *L) {
 int fs_handle_writeString(lua_State *L) {
     lastCFunction = __func__;
     std::iostream * fp = *(std::iostream**)lua_touserdata(L, lua_upvalueindex(1));
-    if (fp == NULL) luaL_error(L, "attempt to use a closed file");
+    if (fp == NULL) return luaL_error(L, "attempt to use a closed file");
     if (lua_isnoneornil(L, 1)) return 0;
-    else if (!lua_isstring(L, 1) && !lua_isnumber(L, 1)) luaL_error(L, "bad argument #1 (string expected, got %s)", lua_typename(L, lua_type(L, 1)));
-    if (fp->fail()) luaL_error(L, "Could not write file");
+    else if (!lua_isstring(L, 1) && !lua_isnumber(L, 1)) return luaL_error(L, "bad argument #1 (string expected, got %s)", lua_typename(L, lua_type(L, 1)));
+    if (fp->eof()) {
+        fp->seekp(0, std::ios::end);
+        fp->clear(fp->rdstate() & ~std::ios::eofbit);
+    }
+    if (!fp->good()) return luaL_error(L, "Could not write file");
     size_t sz = 0;
     const char * str = lua_tolstring(L, 1, &sz);
     fp->write(str, sz);
@@ -197,10 +202,14 @@ int fs_handle_writeString(lua_State *L) {
 int fs_handle_writeLine(lua_State *L) {
     lastCFunction = __func__;
     std::iostream * fp = *(std::iostream**)lua_touserdata(L, lua_upvalueindex(1));
-    if (fp == NULL) luaL_error(L, "attempt to use a closed file");
+    if (fp == NULL) return luaL_error(L, "attempt to use a closed file");
     if (lua_isnoneornil(L, 1)) return 0;
-    else if (!lua_isstring(L, 1) && !lua_isnumber(L, 1)) luaL_error(L, "bad argument #1 (string expected, got %s)", lua_typename(L, lua_type(L, 1)));
-    if (fp->fail()) luaL_error(L, "Could not write file");
+    else if (!lua_isstring(L, 1) && !lua_isnumber(L, 1)) return luaL_error(L, "bad argument #1 (string expected, got %s)", lua_typename(L, lua_type(L, 1)));
+    if (fp->eof()) {
+        fp->seekp(0, std::ios::end);
+        fp->clear(fp->rdstate() & ~std::ios::eofbit);
+    }
+    if (!fp->good()) return luaL_error(L, "Could not write file");
     size_t sz = 0;
     const char * str = lua_tolstring(L, 1, &sz);
     fp->write(str, sz);
@@ -211,8 +220,12 @@ int fs_handle_writeLine(lua_State *L) {
 int fs_handle_writeByte(lua_State *L) {
     lastCFunction = __func__;
     std::iostream * fp = *(std::iostream**)lua_touserdata(L, lua_upvalueindex(1));
-    if (fp == NULL) luaL_error(L, "attempt to use a closed file");
-    if (fp->fail()) luaL_error(L, "Could not write file");
+    if (fp == NULL) return luaL_error(L, "attempt to use a closed file");
+    if (fp->eof()) {
+        fp->seekp(0, std::ios::end);
+        fp->clear(fp->rdstate() & ~std::ios::eofbit);
+    }
+    if (!fp->good()) return luaL_error(L, "Could not write file");
     if (lua_type(L, 1) == LUA_TNUMBER) {
         const char b = (unsigned char)(lua_tointeger(L, 1) & 0xFF);
         fp->put(b);
@@ -221,14 +234,14 @@ int fs_handle_writeByte(lua_State *L) {
         const char * str = lua_tolstring(L, 1, &sz);
         if (sz == 0) return 0;
         fp->write(str, sz);
-    } else luaL_error(L, "bad argument #1 (number or string expected, got %s)", lua_typename(L, lua_type(L, 1)));
+    } else return luaL_error(L, "bad argument #1 (number or string expected, got %s)", lua_typename(L, lua_type(L, 1)));
     return 0;
 }
 
 int fs_handle_flush(lua_State *L) {
     lastCFunction = __func__;
     std::iostream * fp = *(std::iostream**)lua_touserdata(L, lua_upvalueindex(1));
-    if (fp == NULL) luaL_error(L, "attempt to use a closed file");
+    if (fp == NULL) return luaL_error(L, "attempt to use a closed file");
     fp->flush();
 #ifdef __EMSCRIPTEN__
     queueTask([](void*)->void*{syncfs(); return NULL;}, NULL, true);

src/apis/handles/http_handle.cpp

@@ -214,7 +214,6 @@ int req_readLine(lua_State *L) {
     if (*(bool*)lua_touserdata(L, lua_upvalueindex(2)) || !req->stream().good()) return luaL_error(L, "attempt to use a closed file");
     std::string line;
     std::getline(req->stream(), line);
-    line.erase(std::remove(line.begin(), line.end(), '\r'), line.end());
     lua_pushstring(L, line.c_str());
     return 1;
 }
@@ -228,7 +227,6 @@ int req_readAll(lua_State *L) {
     while (req->stream().read(buffer, sizeof(buffer)))
         ret.append(buffer, sizeof(buffer));
     ret.append(buffer, req->stream().gcount());
-    ret.erase(std::remove(ret.begin(), ret.end(), '\r'), ret.end());
     lua_pushstring(L, ret.c_str());
     return 1;
 }
@@ -313,6 +311,7 @@ int res_setStatusCode(lua_State *L) {
     struct http_res * res = (http_res*)lua_touserdata(L, lua_upvalueindex(1));
     if (*(bool*)lua_touserdata(L, lua_upvalueindex(2)) || res->res->sent()) return luaL_error(L, "attempt to use a closed file");
     res->res->setStatus((HTTPResponse::HTTPStatus)luaL_checkinteger(L, 1));
+    if (lua_isstring(L, 2)) res->res->setReason(tostring(L, 2));
     return 0;
 }
 

src/apis/http.cpp

@@ -835,11 +835,10 @@ static int websocket_send(lua_State *L) {
     std::string str = checkstring(L, 1);
     if (config.http_max_websocket_message > 0 && str.size() > (unsigned)config.http_max_websocket_message) luaL_error(L, "Message is too large");
     ws_handle * ws = *(ws_handle**)lua_touserdata(L, lua_upvalueindex(1));
-    if (ws == NULL) luaL_error(L, "attempt to use a closed file");
+    if (ws == NULL) return luaL_error(L, "attempt to use a closed file");
     std::lock_guard<std::mutex> lock(ws->lock);
     if (ws->ws == NULL) return luaL_error(L, "attempt to use a closed file");
-    if (ws->ws->sendFrame(str.c_str(), str.size(), (int)WebSocket::FRAME_FLAG_FIN | (int)(lua_toboolean(L, 2) ? WebSocket::FRAME_BINARY : WebSocket::FRAME_TEXT)) < 1) 
-        websocket_close(L);
+    ws->ws->sendFrame(str.c_str(), str.size(), (int)WebSocket::FRAME_FLAG_FIN | (int)(lua_toboolean(L, 2) ? WebSocket::FRAME_BINARY : WebSocket::FRAME_TEXT));
     return 0;
 }
 

src/platform/CraftOS-PC 2.rc

@@ -60,8 +60,8 @@ MANIFEST                RT_MANIFEST             "..\\..\\resources\\CraftOS-PC.e
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 2,8,2,0
- PRODUCTVERSION 2,8,2,0
+ FILEVERSION 2,8,3,0
+ PRODUCTVERSION 2,8,3,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -77,12 +77,12 @@ BEGIN
         BLOCK "040904b0"
         BEGIN
             VALUE "FileDescription", "CraftOS-PC Accelerated"
-            VALUE "FileVersion", "2.8.2.0"
+            VALUE "FileVersion", "2.8.3.0"
             VALUE "InternalName", "CraftOS-PC.exe"
             VALUE "LegalCopyright", "Copyright (C) 2019-2024 JackMacWindows."
             VALUE "OriginalFilename", "CraftOS-PC.exe"
             VALUE "ProductName", "CraftOS-PC Accelerated"
-            VALUE "ProductVersion", "2.8.2.0"
+            VALUE "ProductVersion", "2.8.3.0"
         END
     END
     BLOCK "VarFileInfo"

src/util.cpp

@@ -165,7 +165,8 @@ inline bool isVFSPath(path_t path) {
     return false;
 }
 
-path_t fixpath(Computer *comp, const std::string& path, bool exists, bool addExt, std::string * mountPath, bool * isRoot) {
+path_t fixpath(Computer *comp, std::string path, bool exists, bool addExt, std::string * mountPath, bool * isRoot) {
+    path.erase(std::remove_if(path.begin(), path.end(), [](char c)->bool {return c == '"' || c == '*' || c == ':' || c == '<' || c == '>' || c == '?' || c == '|' || c < 32; }), path.end());
     std::vector<std::string> elems = split(path, "/\\");
     std::list<std::string> pathc;
     for (std::string s : elems) {
@@ -175,7 +176,6 @@ path_t fixpath(Computer *comp, const std::string& path, bool exists, bool addExt
             else pathc.pop_back();
         } else if (!s.empty() && s.find_first_not_of(' ') != std::string::npos && !std::all_of(s.begin(), s.end(), [](const char c)->bool{return c == '.';})) {
             s = s.substr(s.find_first_not_of(' '), s.find_last_not_of(' ') - s.find_first_not_of(' ') + 1);
-            s.erase(std::remove_if(s.begin(), s.end(), [](char c)->bool{return c=='"'||c==':'||c=='<'||c=='>'||c=='?'||c=='|';}), s.end());
             pathc.push_back(s);
         }
     }
@@ -274,14 +274,14 @@ path_t fixpath(Computer *comp, const std::string& path, bool exists, bool addExt
     return ss;
 }
 
-bool fixpath_ro(Computer *comp, const std::string& path) {
+bool fixpath_ro(Computer *comp, std::string path) {
+    path.erase(std::remove_if(path.begin(), path.end(), [](char c)->bool {return c == '"' || c == '*' || c == ':' || c == '<' || c == '>' || c == '?' || c == '|' || c < 32; }), path.end());
     std::vector<std::string> elems = split(path, "/\\");
     std::list<std::string> pathc;
     for (std::string s : elems) {
         if (s == "..") { if (pathc.empty()) return false; else pathc.pop_back(); }
         else if (!s.empty() && !std::all_of(s.begin(), s.end(), [](const char c)->bool{return c == '.';})) {
             s = s.substr(s.find_first_not_of(' '), s.find_last_not_of(' ') - s.find_first_not_of(' ') + 1);
-            s.erase(std::remove_if(s.begin(), s.end(), [](char c)->bool{return c=='"'||c==':'||c=='<'||c=='>'||c=='?'||c=='|';}), s.end());
             pathc.push_back(s);
         }
     }
@@ -299,14 +299,14 @@ bool fixpath_ro(Computer *comp, const std::string& path) {
     return max_path.second;
 }
 
-std::set<std::string> getMounts(Computer * computer, const std::string& comp_path) {
+std::set<std::string> getMounts(Computer * computer, std::string comp_path) {
+    comp_path.erase(std::remove_if(comp_path.begin(), comp_path.end(), [](char c)->bool {return c == '"' || c == '*' || c == ':' || c == '<' || c == '>' || c == '?' || c == '|' || c < 32; }), comp_path.end());
     std::vector<std::string> elems = split(comp_path, "/\\");
     std::list<std::string> pathc;
     std::set<std::string> retval;
     for (std::string s : elems) {
         if (s == "..") { if (pathc.empty()) return retval; else pathc.pop_back(); }
         else if (!s.empty() && !std::all_of(s.begin(), s.end(), [](const char c)->bool{return c == '.';})) {
-            s.erase(std::remove_if(s.begin(), s.end(), [](char c)->bool{return c=='"'||c==':'||c=='<'||c=='>'||c=='?'||c=='|';}), s.end());
             pathc.push_back(s);
         }
     }

src/util.hpp

@@ -26,8 +26,8 @@ extern "C" {
 #include <Computer.hpp>
 #include <Terminal.hpp>
 
-#define CRAFTOSPC_VERSION    "v2.8.2-luajit"
-#define CRAFTOSPC_CC_VERSION "1.110.2"
+#define CRAFTOSPC_VERSION    "v2.8.3-luajit"
+#define CRAFTOSPC_CC_VERSION "1.112.0"
 #define CRAFTOSPC_INDEV      false
 
 using path_t = std::filesystem::path;
@@ -195,10 +195,10 @@ extern std::vector<std::wstring> split(const std::wstring& strToSplit, const wch
 extern std::vector<path_t> split(const path_t& strToSplit, const path_t::value_type * delimeter);
 extern void load_library(Computer *comp, lua_State *L, const library_t& lib);
 extern void HTTPDownload(const std::string& url, const std::function<void(std::istream*, Poco::Exception*, Poco::Net::HTTPResponse*)>& callback);
-extern path_t fixpath(Computer *comp, const std::string& path, bool exists, bool addExt = true, std::string * mountPath = NULL, bool * isRoot = NULL);
-extern bool fixpath_ro(Computer *comp, const std::string& path);
+extern path_t fixpath(Computer *comp, std::string path, bool exists, bool addExt = true, std::string * mountPath = NULL, bool * isRoot = NULL);
+extern bool fixpath_ro(Computer *comp, std::string path);
 extern path_t fixpath_mkdir(Computer * comp, const std::string& path, bool md = true, std::string * mountPath = NULL);
-extern std::set<std::string> getMounts(Computer * computer, const std::string& comp_path);
+extern std::set<std::string> getMounts(Computer * computer, std::string comp_path);
 extern void peripheral_update(Computer *comp);
 extern struct computer_configuration getComputerConfig(int id);
 extern void setComputerConfig(int id, const computer_configuration& cfg);