LCE-Hub-Mirrors/LCE-Emerald-Launcher
1
2
Fork 0
mirror of https://github.com/LCE-Hub/LCE-Emerald-Launcher.git synced 2026-07-21 01:37:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
339 commits 2 branches 8 tags 51 MiB
Commit graph

101 commits

Author SHA1 Message Date
M1noa b93ecf78a9 fix(LCEL-02): canonicalize parent path for containment check 
the previous canonicalize() call required the resolved dest_dir to
exist, but create_dir_all runs AFTER the check. for new subdirs
the canonicalize fails and we fall back to the raw path, which
defeats the containment check.

canonicalize the existing parent and append the basename instead.
this works whether or not the target dir exists yet.
 2026-07-16 20:25:58 -05:00
M1noa 69998a6ae4 fix(LCEL-02): validate workshop install paths + uninstall paths 
three changes to workshop_install / workshop_uninstall:

1. zip_name from the frontend is now rejected if it contains '..',
   '/', '\\', or starts with '/' or '\\'. prevents the downloaded
   archive from escaping tmp_dir.

2. placeholder is now rejected if it contains '..' or starts with
   '/' or '\\'. after joining to instance_dir, the resolved path
   is canonicalized and asserted to start with instance_dir.canonicalize().
   prevents the install from escaping the instance dir.

3. workshop_uninstall now re-validates every persisted path in
   pkg.dirs against instance_dir.canonicalize() before removing.
   if an attacker injected paths into workshop_packages.json (via
   the install traversals above or via LCEL-01's write primitive),
   uninstall used to delete arbitrary files.

the proper fix is to use a safe zip library (zip-rs) that strips
'..' from members instead of shelling to bsdtar/unzip/tar. left
as a TODO so this commit stays minimal and reviewable.
 2026-07-16 20:25:58 -05:00
/home/neo 5f04f26eb8
bump (#133) 2026-07-12 20:11:06 +03:00
/home/neo 0a32333019
1.6.0 drop 1 (#132) 2026-07-12 20:07:52 +03:00
/home/neo 0594d330be
fix(versions): custom path empty directory, fixes #127 (#131) 2026-07-12 10:06:37 +03:00
str1k3r e8038f3c3e
fix(lceonline): client not opening & webview window for lceonline login (#129) 2026-07-12 09:43:17 +03:00
/home/neo 034fbf5737
feat: 1.5.0 drop 2 (#122) 
Co-authored-by: str1k3r <115313679+S1l3ntStr1ke87@users.noreply.github.com>
 2026-07-11 21:04:53 +03:00
neoapps-dev 7124b4a316 chore: bump 2026-07-06 21:55:04 +03:00
/home/neo 58581203e0
feat(icon): macOS style (#106) 2026-06-30 22:31:11 +03:00
/home/neo 074c1e50b9
feat: titlebar dragging (#103) 2026-06-28 20:48:50 +03:00
/home/neo a94e4ec758
feat: parallel downloads, redesigned download overlay (#100) 2026-06-28 18:12:40 +03:00
/home/neo e2459777b2
feat: neoLegacy official DLCs support (#98) 2026-06-28 17:03:53 +03:00
/home/neo 62b81e5145
feat: bring back titlebar on non-macOS systems, and show on fullscreen (#96) 2026-06-28 15:26:55 +03:00
/home/neo 98f92c3173
feat: download retry and error surfacing (#95) 2026-06-28 14:38:33 +03:00
/home/neo 5d7d2148cc
feat(VersionsMenu): download to custom path (#87) 2026-06-24 19:58:34 +03:00
/home/neo e65ea4e06a
fix: fresh install fullscreen (#86) 2026-06-24 13:41:17 +03:00
/home/neo d90c95da7f
bump (#84) 2026-06-23 18:58:21 +03:00
neoapps-dev 4dc55c918a fix!: bug that deleted the instance right after downloading 2026-06-22 13:58:57 +03:00
neoapps-dev 1c2c73b95c bump 2026-06-22 13:28:16 +03:00
neoapps-dev 1b4d6f590b feat: unzip fallback 2026-06-18 23:55:44 +03:00
neoapps-dev 38fca607fd feat: deeplinks 2026-06-16 19:20:50 +03:00
neoapps-dev 6f64b43358 fix(download+branches): fetch from rust, no update notif without url 2026-06-15 18:16:52 +03:00
neoapps-dev 49e7f823ce feat: customization saving 2026-06-15 18:04:47 +03:00
neoapps-dev 25bc6754d7 fix: delete files AFTER download 2026-06-14 21:37:01 +03:00
neoapps-dev 0f3ddae8c7 feat: workshop plugins 2026-06-14 18:59:35 +03:00
neoapps-dev 8e27a4bed1 feat: initial plugin support 2026-06-14 18:05:20 +03:00
neoapps-dev 8bf6116b05 fix: start fullscreen issues 2026-06-07 23:33:30 +03:00
KayJann bd632e7e0b feat: add new lce team cinematic intro 2026-06-02 01:41:48 +02:00
KayJann d10c4f6876 feat: new splash texts by the community 2026-06-01 10:11:56 +02:00
neoapps-dev 798b037920 fix(macos): missing import 2026-05-27 22:20:09 +03:00
neoapps-dev 0c1b2beced feat: another settings category, launch prefixes, backup&restore and more 2026-05-26 19:15:56 +03:00
neoapps-dev 3525bd6523 bump 2026-05-26 17:00:22 +03:00
neoapps-dev c3c3abb2e3 feat: playtime counting 2026-05-25 17:46:56 +03:00
neoapps-dev e1a49069f0 remove lce bridge its a PAIN 2026-05-25 14:33:35 +03:00
neoapps-dev 114e775b2a feat: java bridge 2026-05-25 13:23:01 +03:00
neoapps-dev 3a7335f43d chore: remove console2lce because IT DOESNT WORK 2026-05-24 11:27:21 +03:00
neoapps-dev f85829c88c feat: initial support for importing worlds 2026-05-23 22:11:18 +03:00
neoapps-dev a647f0c7dc feat(rust): full refactor to everything. now code is readable 2026-05-23 18:56:16 +03:00
neoapps-dev 1c88642e5c fix: compile issues 2026-05-21 19:43:40 +03:00
neoapps-dev e6d88173d6 feat(LCELive): add -ip, -port and -quitondisconnect for neoLegacy 2026-05-21 14:14:45 +03:00
neoapps-dev 773da39fe1 fix(Windows): hide cmd.exe window on extraction 2026-05-21 13:49:27 +03:00
neoapps-dev d85c9b2a2c feat(Workshop): collab with ByteBukkit to bring plugins and servers 2026-05-17 21:57:20 +03:00
neoapps-dev f43698aea4 feat: bring back servers.db manipulation 2026-05-17 14:45:11 +03:00
neoapps-dev c2fb9ece72 fix: get rid of UDP broadcase and use port 61000 instead of a random port 2026-05-17 14:11:32 +03:00
neoapps-dev 558878f9df ci: build artifacts 2026-05-16 20:37:13 +03:00
neoapps-dev be910f2334 chore: bump 2026-05-16 20:24:59 +03:00
/home/neo 46e04a7c4b
merge experimental into main (#42) 2026-05-16 20:23:15 +03:00
/home/neo f2398aad23
v1.2.0 (#33) 2026-05-15 20:31:41 +03:00
neoapps-dev 5fb311859a revert steamworks, causes problems for now 2026-05-01 23:13:37 +03:00
neoapps-dev b01b1273b1 feat: initial steamworks support 2026-05-01 22:31:29 +03:00