Possible coding issues #1295

Closed

opened 2026-11-09 21:05:22 +00:00 by Demonicmurderer · 1 comment

Demonicmurderer commented

2026-11-09 21:05:22 +00:00

(Migrated from github.com)

Builder version

v2.0.11

How you built

Hookshot Builder app (Windows)

Game files given to it

A .nup

The error

Potential vulnerability: Linux archive extraction
File: builder/linux/linux_update.py
Lines: 293–317

The installer checks archive filenames for absolute paths and .. directory traversal. That's good.

However, it also accepts symbolic links:
if stat.S_ISLNK(mode):    os.symlink(zipped.read(info).decode("utf-8"), target)else:    with open(target, "wb") as out:        out.write(zipped.read(info))


The problem: It doesn't verify that a symbolic link's destination remains within the installation directory.

A malicious archive could potentially create a symbolic link pointing outside the installation directory, then write subsequent files through that link.

This is a potentially exploitable archive-extraction weakness, although I haven't demonstrated exploitation.

The updater does verify downloaded archives against SHA-256 values from a release manifest. That helps detect corrupted or substituted downloads, but it does not protect against a malicious archive supplied through a compromised release.

Severity: Potentially high if an attacker can control the release manifest and its archives.
Recursive deletion behavior
I inspected builder/HookshotBuilder/Storage.cs.

The code contains:
if (Directory.Exists(path))
    Directory.Delete(path, recursive: true);

The function is used for clearing build artifacts and cached files.

The current implementation appears intended to delete specific build directories rather than arbitrary user files.

However, there is a concern: the selected build location can be configured, and recursive deletion relies on the calculated paths being correct.

Visual Studio or Build Tools version, and Windows SDK version

No response

Operating system and free space on the output drive

Tiny 11 26H2 1.13TB

Before you send it

I'm on the newest release, or it still fails on it.
I searched the open issues for this error.
I'm not attaching game files or anything built from them.

### Builder version v2.0.11 ### How you built Hookshot Builder app (Windows) ### Game files given to it A .nup ### The error ```text Potential vulnerability: Linux archive extraction File: builder/linux/linux_update.py Lines: 293–317 The installer checks archive filenames for absolute paths and .. directory traversal. That's good. However, it also accepts symbolic links: if stat.S_ISLNK(mode): os.symlink(zipped.read(info).decode("utf-8"), target)else: with open(target, "wb") as out: out.write(zipped.read(info)) The problem: It doesn't verify that a symbolic link's destination remains within the installation directory. A malicious archive could potentially create a symbolic link pointing outside the installation directory, then write subsequent files through that link. This is a potentially exploitable archive-extraction weakness, although I haven't demonstrated exploitation. The updater does verify downloaded archives against SHA-256 values from a release manifest. That helps detect corrupted or substituted downloads, but it does not protect against a malicious archive supplied through a compromised release. Severity: Potentially high if an attacker can control the release manifest and its archives. Recursive deletion behavior I inspected builder/HookshotBuilder/Storage.cs. The code contains: if (Directory.Exists(path)) Directory.Delete(path, recursive: true); The function is used for clearing build artifacts and cached files. The current implementation appears intended to delete specific build directories rather than arbitrary user files. However, there is a concern: the selected build location can be configured, and recursive deletion relies on the calculated paths being correct. ``` ### Visual Studio or Build Tools version, and Windows SDK version _No response_ ### Operating system and free space on the output drive Tiny 11 26H2 1.13TB ### Before you send it - [x] I'm on the newest release, or it still fails on it. - [x] I searched the open issues for this error. - [x] I'm not attaching game files or anything built from them.

NotRexed commented

2026-11-11 21:22:32 +00:00

(Migrated from github.com)

Thanks for the report. Reports of the same problem are now collected in #2045, which lists this one with your details and links back here, so one fix closes them together and the open list stays readable. Follow #2045 for the fix, and add new details there (or here). If this turns out to be a separate problem it will be reopened.