chore: make security exceptions better

heliosphere-xiv · Aug 20, 2024 · bf00846 · bf00846
1 parent ce98f0c
commit bf00846
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/ConvertTask.cs b/ConvertTask.cs
@@ -110,8 +110,9 @@ internal async Task Run() {
             var outputPaths = DownloadTask.GetOutputPaths(files);
             foreach (var shortOutputPath in outputPaths) {
                 var outputPath = Path.Join(filesPath, shortOutputPath);
-                if (PathHelper.MakeRelativeSub(filesPath, Path.GetFullPath(outputPath)) == null) {
-                    throw new SecurityException("path from mod was attempting to leave the files directory");
+                var fullOutputPath = Path.GetFullPath(outputPath);
+                if (PathHelper.MakeRelativeSub(filesPath, fullOutputPath) == null) {
+                    throw new SecurityException($"path from mod was attempting to leave the files directory: '{fullOutputPath}' is not within '{filesPath}'");
                 }
 
                 if (outputPath.Equals(existingPath, StringComparison.InvariantCultureIgnoreCase)) {

diff --git a/DownloadTask.cs b/DownloadTask.cs
@@ -829,7 +829,7 @@ private async Task DownloadFile(Uri baseUri, string filesPath, string[] outputPa
             var joined = Path.GetFullPath(Path.Join(filesPath, outputPath));
             // check that this path is under the files path still
             if (PathHelper.MakeRelativeSub(filesPath, joined) == null) {
-                throw new SecurityException("path from mod was attempting to leave the files directory");
+                throw new SecurityException($"path from mod was attempting to leave the files directory: '{joined}' is not within '{filesPath}'");
             }
 
             if (validPath == null && await CheckHash(joined, hash)) {