CVE-2015-5069: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 4.3
Published: 2017-09-26T14:29Z
Repository: https://github.com/wesnoth/wesnoth
Language: C++
Files changed: changelog, src/filesystem.cpp, src/filesystem_boost.cpp
Commit date: 2015-06-09 06:19:17 -0300
Commit message: Disallow inclusion of .pbl files from WML (bug #23504)

Note that this will also cause Lua wesnoth.have_file() to return false
on .pbl files.

Diff: diff --git a/changelog b/changelog
index e1ea3fe2b6..606ad814b8 100644
--- a/changelog
+++ b/changelog
@@ -63,10 +63,11 @@ Version 1.13.0+dev:
    * Fixed unbound memory read in the MP map selection screen that could lead
      to a segmentation fault or other abnormal behavior (bug #23606).
    * Made silence.ogg larger to work around a crash involving the multiplayer
      lobby with music and sound enabled (bug #23633, possibly also bug #23599,
      bug #23203, bug #23026).
+   * Disallowed inclusion of .pbl files from WML (bug #23504).
 
 Version 1.13.0:
  * Security fixes:
    * Fixed arbitrary file read from WML/Lua API (CVE-2015-0844, bug #23440).
  * Add-ons client:
diff --git a/src/filesystem.cpp b/src/filesystem.cpp
index b76e07fe12..7d5adb60d7 100644
--- a/src/filesystem.cpp
+++ b/src/filesystem.cpp
@@ -1006,10 +1006,15 @@ std::string get_wml_location(const std::string &filename, const std::string &cur
 	if (filename.find("..") != std::string::npos) {
 		ERR_FS << "Illegal path '" << filename << "' (\"..\" not allowed)." << std::endl;
 		return result;
 	}
 
+	if (ends_with(filename, ".pbl")) {
+		ERR_FS << "Illegal path '" << filename << "' (.pbl files are not allowed)." << std::endl;
+		return result;
+	}
+
 	bool already_found = false;
 
 	if (filename[0] == '~')
 	{
 		// If the filename starts with '~', look in the user data directory.
diff --git a/src/filesystem_boost.cpp b/src/filesystem_boost.cpp
index 9a8722eafa..21b582159e 100644
--- a/src/filesystem_boost.cpp
+++ b/src/filesystem_boost.cpp
@@ -998,10 +998,15 @@ static bool is_legal_file(const std::string &filename)
 	if (filename.find("..") != std::string::npos) {
 		ERR_FS << "Illegal path '" << filename << "' (\"..\" not allowed).\n";
 		return false;
 	}
 
+	if (ends_with(filename, ".pbl")) {
+		ERR_FS << "Illegal path '" << filename << "' (.pbl files are not allowed)." << std::endl;
+		return false;
+	}
+
 	return true;
 }
 
 /**
  * Returns a vector with all possible paths to a given type of binary,

Fixed code:    * Disallowed inclusion of .pbl files from WML (bug #23504).
	if (ends_with(filename, ".pbl")) {
		ERR_FS << "Illegal path '" << filename << "' (.pbl files are not allowed)." << std::endl;
		return result;
	}

	if (ends_with(filename, ".pbl")) {
		ERR_FS << "Illegal path '" << filename << "' (.pbl files are not allowed)." << std::endl;
		return false;
	}