This commit is contained in:
@@ -57,11 +57,26 @@ public sealed class TemplateLoader(TemplateLimits? limits = null,
|
||||
if (manifest.SchemaVersion != CurrentSchemaVersion)
|
||||
throw Error($"schemaVersion {manifest.SchemaVersion} wird nicht unterstützt.");
|
||||
if (!IsSafeRelativePath(manifest.LayoutFile)) throw Error("layoutFile enthält einen unsicheren Pfad.");
|
||||
if (!IsSafeRelativePath(manifest.MetadataFile)) throw Error("metadataFile enthält einen unsicheren Pfad.");
|
||||
if (Normalize(manifest.MetadataFile).Equals(Normalize(manifest.LayoutFile), StringComparison.OrdinalIgnoreCase))
|
||||
throw Error("metadataFile und layoutFile dürfen nicht identisch sein.");
|
||||
if (!entries.TryGetValue(Normalize(manifest.LayoutFile), out var layoutEntry))
|
||||
throw Error($"Layoutdatei „{manifest.LayoutFile}“ fehlt.");
|
||||
|
||||
string layoutSource;
|
||||
using (var reader = new StreamReader(layoutEntry.Open())) layoutSource = reader.ReadToEnd();
|
||||
var metadataPath = Normalize(manifest.MetadataFile);
|
||||
manifest.Metadata = new(StringComparer.OrdinalIgnoreCase);
|
||||
if (entries.TryGetValue(metadataPath, out var metadataEntry))
|
||||
{
|
||||
if (metadataEntry.Length > 1024 * 1024) throw Error("metadata.txt überschreitet das Größenlimit.");
|
||||
try
|
||||
{
|
||||
using var reader = new StreamReader(metadataEntry.Open());
|
||||
manifest.Metadata = TemplateMetadataText.Parse(reader.ReadToEnd());
|
||||
}
|
||||
catch (InvalidDataException ex) { throw Error($"{manifest.MetadataFile} ist ungültig: {ex.Message}"); }
|
||||
}
|
||||
var layout = new LayoutParser().Parse(layoutSource);
|
||||
var referencedAssets = layout.Elements.Select(AssetPath).Where(x => x is not null).Cast<string>()
|
||||
.Select(Normalize).Distinct(StringComparer.OrdinalIgnoreCase).ToList();
|
||||
@@ -76,7 +91,8 @@ public sealed class TemplateLoader(TemplateLimits? limits = null,
|
||||
var layoutPath = Normalize(manifest.LayoutFile);
|
||||
foreach (var (path, asset) in entries.Where(x =>
|
||||
!x.Key.Equals("manifest.json", StringComparison.OrdinalIgnoreCase)
|
||||
&& !x.Key.Equals(layoutPath, StringComparison.OrdinalIgnoreCase)))
|
||||
&& !x.Key.Equals(layoutPath, StringComparison.OrdinalIgnoreCase)
|
||||
&& !x.Key.Equals(metadataPath, StringComparison.OrdinalIgnoreCase)))
|
||||
{
|
||||
if (asset.Length > _limits.MaxAssetBytes)
|
||||
{ issues.Add(new(ValidationSeverity.Error, $"Bild „{path}“ überschreitet das Größenlimit.")); continue; }
|
||||
|
||||
Reference in New Issue
Block a user