Fixed IsFilepathSafe util function. (#190)

cleolibrary · Sep 13, 2024 · d68bec4 · d68bec4
1 parent b099c1c
commit d68bec4
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/cleo_sdk/CLEO_Utils.h b/cleo_sdk/CLEO_Utils.h
@@ -122,10 +122,10 @@ namespace CLEO
     // does file path points inside game directories? (game root or user files)
     static bool IsFilepathSafe(CLEO::CRunningScript* thread, const char* path)
     {
-        auto IsSubpath = [](std::filesystem::path path, std::filesystem::path base) 
+        auto IsSubpath = [](std::filesystem::path path, std::filesystem::path base)
         {
-            auto relative = std::filesystem::relative(base, path);
-            return relative.empty() || relative.native()[0] != '.';
+            auto relative = std::filesystem::relative(path, base);
+            return !relative.empty() && *relative.begin() != "..";
         };
 
         auto fsPath = std::filesystem::path(path);