Need help with file manipulation

[Pumaman]

Restricting to subdirectories is actually more tricky because there are various sneaky tricks that people can use to get around path checking. I'm sure you've heard of security holes in software like IIS where you can specify the path as "subdir\..\..\..\windows\system32\driver.sys" and so forth.

The present method of simply disallowing / and \ characters in the path is the safest way of doing things.

Anyway, since there's support for FileRename and FileDelete I'll certainly consider them for a future version.

[strazer]

Tracker'd:
http://www.adventuregamestudio.co.uk/tracker.php?action=detail&id=381
http://www.adventuregamestudio.co.uk/tracker.php?action=detail&id=525

[GarageGothic]

Restricting to subdirectories is actually more tricky because there are various sneaky tricks that people can use to get around path checking. I'm sure you've heard of security holes in software like IIS where you can specify the path as "subdir\..\..\..\windows\system32\driver.sys" and so forth.The present method of simply disallowing / and \ characters in the path is the safest way of doing things.

Why not just disallow multiple periods? I see little need for more full stops in a file name than the one preceeding the file extension.

[Gilbert]

Still, that doesn't help if you do something like:
FileDelete("\aut0exec.bat");

[GarageGothic]

Would that first slash take you to the root directory? I didn't know that. But wouldn't banning the first character from being a backslash guard against that? Or do you mean that autoexec.bat is in the path so it's accessible from anywhere?

[Snarky]

Couldn't you take the path and the filename as two separate parameters? That way you could check to see which directory the path resolved to, and then only perform the action if it is the game directory or a subdirectory. (Of course, you'd have to make sure there's no path fragment in the filename, by simply disallowing \ and / in that string.)

[Gilbert]

I think one reasonable implication is:

FileDelete(String name, String path="");

where / \ : and . are not allowed in both parameters (should generate a warning and crash out).

However, I doubt if it's really that important to go through all these problems.