From 19e848916647a305711eaa2919656f3b4a6e0634 Mon Sep 17 00:00:00 2001 From: Erik Meyer Date: Tue, 19 Aug 2025 15:48:43 -0400 Subject: [PATCH 1/5] feat: add html assets extraction from zip files in ControlSystem --- src/PepperDash.Essentials/ControlSystem.cs | 53 ++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/src/PepperDash.Essentials/ControlSystem.cs b/src/PepperDash.Essentials/ControlSystem.cs index 4ca61e66..59137b98 100644 --- a/src/PepperDash.Essentials/ControlSystem.cs +++ b/src/PepperDash.Essentials/ControlSystem.cs @@ -597,6 +597,59 @@ namespace PepperDash.Essentials File.Delete(file.FullName); } + var htmlZipFiles = applicationDirectory.GetFiles("htmlassets*.zip"); + + if (htmlZipFiles.Length > 1) + { + throw new Exception("Multiple htmlassets zip files found. Cannot continue."); + } + + + if (htmlZipFiles.Length == 1) + { + var htmlZipFile = htmlZipFiles[0]; + var programDir = new DirectoryInfo(Global.FilePathPrefix.TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar)); + var userOrNvramDir = programDir.Parent; + var rootDir = userOrNvramDir?.Parent; + if (rootDir == null) + { + throw new Exception("Unable to determine root directory for html extraction."); + } + var htmlDir = Path.Combine(rootDir.FullName, "html"); + Debug.LogMessage(LogEventLevel.Information, "Found htmlassets zip file: {zipFile:l}... Unzipping...", htmlZipFile.FullName); + using (var archive = ZipFile.OpenRead(htmlZipFile.FullName)) + { + foreach (var entry in archive.Entries) + { + var destinationPath = Path.Combine(htmlDir, entry.FullName); + + // If the entry is a directory, ensure it exists and skip extraction + if (string.IsNullOrEmpty(entry.Name)) + { + Directory.CreateDirectory(destinationPath); + continue; + } + + // Only delete the file if it exists and is a file, not a directory + if (File.Exists(destinationPath)) + File.Delete(destinationPath); + + // Ensure the parent directory exists + Directory.CreateDirectory(Path.GetDirectoryName(destinationPath)); + + entry.ExtractToFile(destinationPath, true); + + Debug.LogMessage(LogEventLevel.Information, "Extracted: {entry:l} to {Destination}", entry.FullName, destinationPath); + } + } + } + + // cleaning up html zip files + foreach (var file in htmlZipFiles) + { + File.Delete(file.FullName); + } + var jsonFiles = applicationDirectory.GetFiles("*configurationFile*.json"); if (jsonFiles.Length > 1) From 52916d29f4667dadc569eb1ee24d566ab44526ec Mon Sep 17 00:00:00 2001 From: Neil Dorin Date: Tue, 19 Aug 2025 14:53:06 -0600 Subject: [PATCH 2/5] Update src/PepperDash.Essentials/ControlSystem.cs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- src/PepperDash.Essentials/ControlSystem.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/PepperDash.Essentials/ControlSystem.cs b/src/PepperDash.Essentials/ControlSystem.cs index 59137b98..0d508b33 100644 --- a/src/PepperDash.Essentials/ControlSystem.cs +++ b/src/PepperDash.Essentials/ControlSystem.cs @@ -601,7 +601,7 @@ namespace PepperDash.Essentials if (htmlZipFiles.Length > 1) { - throw new Exception("Multiple htmlassets zip files found. Cannot continue."); + throw new Exception("Multiple htmlassets zip files found in application directory. Please ensure only one htmlassets*.zip file is present and retry."); } From d013068a0c61cc6788c346cc50a2a0d6fd3a9dac Mon Sep 17 00:00:00 2001 From: Neil Dorin Date: Tue, 19 Aug 2025 14:54:11 -0600 Subject: [PATCH 3/5] Update src/PepperDash.Essentials/ControlSystem.cs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- src/PepperDash.Essentials/ControlSystem.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/PepperDash.Essentials/ControlSystem.cs b/src/PepperDash.Essentials/ControlSystem.cs index 0d508b33..554c7bc9 100644 --- a/src/PepperDash.Essentials/ControlSystem.cs +++ b/src/PepperDash.Essentials/ControlSystem.cs @@ -613,7 +613,7 @@ namespace PepperDash.Essentials var rootDir = userOrNvramDir?.Parent; if (rootDir == null) { - throw new Exception("Unable to determine root directory for html extraction."); + throw new Exception($"Unable to determine root directory for html extraction. Current path: {Global.FilePathPrefix}"); } var htmlDir = Path.Combine(rootDir.FullName, "html"); Debug.LogMessage(LogEventLevel.Information, "Found htmlassets zip file: {zipFile:l}... Unzipping...", htmlZipFile.FullName); From 06dc0e947eb1e797fc7d27cdb544402a602a5f18 Mon Sep 17 00:00:00 2001 From: erikdred <88980320+erikdred@users.noreply.github.com> Date: Fri, 22 Aug 2025 09:12:20 -0400 Subject: [PATCH 4/5] fix: check for null when getting directory Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- src/PepperDash.Essentials/ControlSystem.cs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/PepperDash.Essentials/ControlSystem.cs b/src/PepperDash.Essentials/ControlSystem.cs index 554c7bc9..c04080f3 100644 --- a/src/PepperDash.Essentials/ControlSystem.cs +++ b/src/PepperDash.Essentials/ControlSystem.cs @@ -635,7 +635,9 @@ namespace PepperDash.Essentials File.Delete(destinationPath); // Ensure the parent directory exists - Directory.CreateDirectory(Path.GetDirectoryName(destinationPath)); + var parentDir = Path.GetDirectoryName(destinationPath); + if (!string.IsNullOrEmpty(parentDir)) + Directory.CreateDirectory(parentDir); entry.ExtractToFile(destinationPath, true); From c3b39a87da8d922acd8a9d39298cb0d9510afd79 Mon Sep 17 00:00:00 2001 From: Erik Meyer Date: Fri, 22 Aug 2025 15:15:02 -0400 Subject: [PATCH 5/5] fix: enhance zip extraction to prevent directory traversal attacks --- src/PepperDash.Essentials/ControlSystem.cs | 24 +++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/src/PepperDash.Essentials/ControlSystem.cs b/src/PepperDash.Essentials/ControlSystem.cs index c04080f3..b2fe1e19 100644 --- a/src/PepperDash.Essentials/ControlSystem.cs +++ b/src/PepperDash.Essentials/ControlSystem.cs @@ -563,14 +563,21 @@ namespace PepperDash.Essentials if (zipFiles.Length == 1) { var zipFile = zipFiles[0]; + var assetsRoot = System.IO.Path.GetFullPath(Global.FilePathPrefix); + if (!assetsRoot.EndsWith(Path.DirectorySeparatorChar.ToString()) && !assetsRoot.EndsWith(Path.AltDirectorySeparatorChar.ToString())) + { + assetsRoot += Path.DirectorySeparatorChar; + } Debug.LogMessage(LogEventLevel.Information, "Found assets zip file: {zipFile:l}... Unzipping...", zipFile.FullName); using (var archive = ZipFile.OpenRead(zipFile.FullName)) { foreach (var entry in archive.Entries) { var destinationPath = Path.Combine(Global.FilePathPrefix, entry.FullName); + var fullDest = System.IO.Path.GetFullPath(destinationPath); + if (!fullDest.StartsWith(assetsRoot, StringComparison.OrdinalIgnoreCase)) + throw new InvalidOperationException($"Entry '{entry.FullName}' is trying to extract outside of the target directory."); - // If the entry is a directory, ensure it exists and skip extraction if (string.IsNullOrEmpty(entry.Name)) { Directory.CreateDirectory(destinationPath); @@ -581,11 +588,8 @@ namespace PepperDash.Essentials if (Directory.Exists(destinationPath)) Directory.Delete(destinationPath, true); - // Ensure the parent directory exists Directory.CreateDirectory(Path.GetDirectoryName(destinationPath)); - entry.ExtractToFile(destinationPath, true); - Debug.LogMessage(LogEventLevel.Information, "Extracted: {entry:l} to {Destination}", entry.FullName, destinationPath); } } @@ -616,14 +620,22 @@ namespace PepperDash.Essentials throw new Exception($"Unable to determine root directory for html extraction. Current path: {Global.FilePathPrefix}"); } var htmlDir = Path.Combine(rootDir.FullName, "html"); + var htmlRoot = System.IO.Path.GetFullPath(htmlDir); + if (!htmlRoot.EndsWith(Path.DirectorySeparatorChar.ToString()) && + !htmlRoot.EndsWith(Path.AltDirectorySeparatorChar.ToString())) + { + htmlRoot += Path.DirectorySeparatorChar; + } Debug.LogMessage(LogEventLevel.Information, "Found htmlassets zip file: {zipFile:l}... Unzipping...", htmlZipFile.FullName); using (var archive = ZipFile.OpenRead(htmlZipFile.FullName)) { foreach (var entry in archive.Entries) { var destinationPath = Path.Combine(htmlDir, entry.FullName); + var fullDest = System.IO.Path.GetFullPath(destinationPath); + if (!fullDest.StartsWith(htmlRoot, StringComparison.OrdinalIgnoreCase)) + throw new InvalidOperationException($"Entry '{entry.FullName}' is trying to extract outside of the target directory."); - // If the entry is a directory, ensure it exists and skip extraction if (string.IsNullOrEmpty(entry.Name)) { Directory.CreateDirectory(destinationPath); @@ -634,13 +646,11 @@ namespace PepperDash.Essentials if (File.Exists(destinationPath)) File.Delete(destinationPath); - // Ensure the parent directory exists var parentDir = Path.GetDirectoryName(destinationPath); if (!string.IsNullOrEmpty(parentDir)) Directory.CreateDirectory(parentDir); entry.ExtractToFile(destinationPath, true); - Debug.LogMessage(LogEventLevel.Information, "Extracted: {entry:l} to {Destination}", entry.FullName, destinationPath); } }