CVE-2015-5070: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 3.1
Published: 2017-09-26T14:29Z
Repository: https://github.com/wesnoth/wesnoth
Language: Other
Files changed: changelog, players_changelog, src/filesystem.cpp, src/filesystem_boost.cpp
Commit date: 2015-06-16 23:24:30 -0300
Commit message: Use looks_like_pbl() to disallow .pbl file inclusion (bug #23504)

This function is implemented using case-insensitive pattern matching,
unlike filesystem::ends_with(). I missed this when writing my original
fix, so the vulnerability still applied to .pbl files on a
case-insensitive filesystem (e.g. NTFS and FAT* on Windows) by using
different case to bypass the check.

Diff: diff --git a/changelog b/changelog
index 7f1d62c8f1f..9554b610b1e 100644
--- a/changelog
+++ b/changelog
@@ -1,8 +1,9 @@
 Version 1.13.0+dev:
  * Security fixes:
-   * Disallowed inclusion of .pbl files from WML (bug #23504).
+   * Disallowed inclusion of .pbl files from WML (bug #23504), independent of
+     file name case.
  * AI:
    * Fast Micro AI: exclude hidden enemies from attack evaluation by default;
      add optional key attack_hidden_enemies to override this
    * Lua AI helper functions: fix bug crashing the AI when number= is not set in
      a unit attack definition
diff --git a/players_changelog b/players_changelog
index 3ab0758dc62..0a1019e2e0e 100644
--- a/players_changelog
+++ b/players_changelog
@@ -2,11 +2,12 @@ This is meant to be a concise list of player-visible changes (very minor
 changes may be omitted). For a complete list of changes, see the main
 changelog: https://github.com/wesnoth/wesnoth/blob/master/changelog
 
 Version 1.13.0+dev:
  * Security fixes:
-   * Disallowed inclusion of .pbl files from WML (bug #23504).
+   * Disallowed inclusion of .pbl files from WML (bug #23504), independent of
+     file name case.
 
  * Campaigns:
    * Dead Water:
      * The Stun effect now expires at the stunned unit's side turn end
    * Under the Burning Suns:
diff --git a/src/filesystem.cpp b/src/filesystem.cpp
index 7d5adb60d78..01cd577b1fb 100644
--- a/src/filesystem.cpp
+++ b/src/filesystem.cpp
@@ -1006,11 +1006,11 @@ std::string get_wml_location(const std::string &filename, const std::string &cur
 	if (filename.find("..") != std::string::npos) {
 		ERR_FS << "Illegal path '" << filename << "' (\"..\" not allowed)." << std::endl;
 		return result;
 	}
 
-	if (ends_with(filename, ".pbl")) {
+	if (looks_like_pbl(filename)) {
 		ERR_FS << "Illegal path '" << filename << "' (.pbl files are not allowed)." << std::endl;
 		return result;
 	}
 
 	bool already_found = false;
diff --git a/src/filesystem_boost.cpp b/src/filesystem_boost.cpp
index 21b582159e1..08cbd2666f6 100644
--- a/src/filesystem_boost.cpp
+++ b/src/filesystem_boost.cpp
@@ -998,11 +998,11 @@ static bool is_legal_file(const std::string &filename)
 	if (filename.find("..") != std::string::npos) {
 		ERR_FS << "Illegal path '" << filename << "' (\"..\" not allowed).\n";
 		return false;
 	}
 
-	if (ends_with(filename, ".pbl")) {
+	if (looks_like_pbl(filename)) {
 		ERR_FS << "Illegal path '" << filename << "' (.pbl files are not allowed)." << std::endl;
 		return false;
 	}
 
 	return true;

Vulnerable code:    * Disallowed inclusion of .pbl files from WML (bug #23504).
   * Disallowed inclusion of .pbl files from WML (bug #23504).
	if (ends_with(filename, ".pbl")) {
	if (ends_with(filename, ".pbl")) {
Fixed code:    * Disallowed inclusion of .pbl files from WML (bug #23504), independent of
     file name case.
   * Disallowed inclusion of .pbl files from WML (bug #23504), independent of
     file name case.
	if (looks_like_pbl(filename)) {
	if (looks_like_pbl(filename)) {