mirror of
https://github.com/RetroPortingToolKit/psxrecomp
synced 2026-10-26 18:25:35 -04:00
luisg0c
4ced15faf4
std::filesystem answers by the *host* path grammar, so this guard meant different things on different hosts. Under POSIX, "C:/outside" is a relative path whose first component is literally "C:", a backslash is an ordinary filename character, and "\\server\share" is a single relative component -- so Windows-authored absolute paths and backslash ".." traversals were accepted. Under Windows, a rooted "/outside" has no root name, so operator/ drops the project root's relative path and the result lands at the drive root; and a drive-relative "C:foo" is not absolute at all, yet replaces the whole path when the project sits on another drive. Scan the raw config bytes under both separator conventions instead, and reject an embedded NUL. TOML forbids a raw NUL byte but allows the \u0000 escape that produces one, and the runtime hands this value on as a C string (runtime/src/main.cpp:5236-5241 -> overlay_capture.c:230), so "..\u0000keep" validated as a four-byte component and then truncated to ".." at the point of use, escaping the project. Validating what the consumer actually sees closes that gap. recompiler/src/config_loader.h carries the contract next to the field and still described the old, narrower rule; docs/AOT_OVERLAY_PLAN.md carries the only prose statement of it. Both now match what is enforced. Note the doc claims identical accept/reject across hosts, not identical meaning: a value like "nested\dir" is accepted everywhere but still names different things. The registered recompiler_patch_test assertion "parser rejects absolute capture history directory" failed on POSIX before this; the suite is now 33/33 on macOS arm64.