[MCPE-8124] MCPE does not check world names for impermissible characters

I created a world with the name "../" without the quotes.

what happened: The world files were saved under /mnt/games/com.mojang/

what I expected to happen: the world filed would be saved under /mnt/games/com.mojang/minecraftWorlds/SOMETHING where SOMETHING is some folder name used when you name your world something that uses impermissible file name characters.

This bug does not appear to be a security flaw/risk because MCPE gives a "can't open world" if you try to make a world that writes to a place you can't access.

Also, after quiting to the menu, this world will never appear in the world list because it's not in the right folder.

Device is Samsung Galaxy S4 android 4.4.2 running MCPE 0.10.5.

Attachments1

Screenshot_2015-03-29-21-39-47.png

rplatham

2015-03-30, 04:46:14 AM

Comments4

rplatham 2015-03-30, 04:47:55 AM

Not sure if file system bugs go to Shoghi or Daniel, so I flipped a coin. Congrats Shoghi

Katten 2015-03-30, 06:17:30 AM

Hi Russell, this issue does not occur using 0.10.4 on an iPhone 6 plus running iOS 8.2. Attempting to use the "/" character does not result in it being entered into the world name.

AMAN4700 2015-03-31, 04:47:30 AM

What is the chance your gonna name your world ../?

Jeroen Gilissen 2015-04-04, 02:00:44 PM

I named a world " .. " without the quotes, and it indeed didn't show up in my world list.

History6

rplatham 2015-03-30, 04:46:14 AM

Added attachment:

Screenshot_2015-03-29-21-39-47.png

Changed description:

I created a world with the name "../" without the quotes.

what happened: The world files were saved under /mnt/games/com.mojang/

I am concerned that this bug could be a security flaw/risk as it may allow users to write files to locations the user should not be able to write to.

Also, after quiting to the menu, this world will never appear in the world list because it's not in the right folder.

Device is Samsung Galaxy S4 android 4.4.2 running MCPE 0.10.5.

I created a world with the name "../" without the quotes.

what happened: The world files were saved under /mnt/games/com.mojang/

This bug does not appear to be a security flaw/risk because MCPE gives a "can't open world" if you try to make a world that writes to a place you can't access.

Also, after quiting to the menu, this world will never appear in the world list because it's not in the right folder.

Device is Samsung Galaxy S4 android 4.4.2 running MCPE 0.10.5.

Added labels: Files Folders Saving

Removed labels:

rplatham 2015-03-30, 04:47:55 AM

Added Assignee: [Mojang] Shoghi Cervantes

[Mojang] Shoghi Cervantes 2015-03-31, 01:04:59 PM

Resolution: Unresolved → Fixed

Added affects versions: 0.11.0

Deleted account 2015-09-07, 10:44:46 AM

Added labels: files saving folders

Removed labels: Files Folders Saving