{"action":"opened","issue":{"url":"https://api.github.com/repos/syldrathecat/nxtlauncher/issues/10","repository_url":"https://api.github.com/repos/syldrathecat/nxtlauncher","labels_url":"https://api.github.com/repos/syldrathecat/nxtlauncher/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/syldrathecat/nxtlauncher/issues/10/comments","events_url":"https://api.github.com/repos/syldrathecat/nxtlauncher/issues/10/events","html_url":"https://github.com/syldrathecat/nxtlauncher/issues/10","id":223810959,"number":10,"title":"The launcher can save files to any location","user":{"login":"syldrathecat","id":13056379,"avatar_url":"https://avatars1.githubusercontent.com/u/13056379?v=3","gravatar_id":"","url":"https://api.github.com/users/syldrathecat","html_url":"https://github.com/syldrathecat","followers_url":"https://api.github.com/users/syldrathecat/followers","following_url":"https://api.github.com/users/syldrathecat/following{/other_user}","gists_url":"https://api.github.com/users/syldrathecat/gists{/gist_id}","starred_url":"https://api.github.com/users/syldrathecat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/syldrathecat/subscriptions","organizations_url":"https://api.github.com/users/syldrathecat/orgs","repos_url":"https://api.github.com/users/syldrathecat/repos","events_url":"https://api.github.com/users/syldrathecat/events{/privacy}","received_events_url":"https://api.github.com/users/syldrathecat/received_events","type":"User","site_admin":false},"labels":[{"id":590691413,"url":"https://api.github.com/repos/syldrathecat/nxtlauncher/labels/security","name":"security","color":"b60205","default":false}],"state":"open","locked":false,"assignee":{"login":"syldrathecat","id":13056379,"avatar_url":"https://avatars1.githubusercontent.com/u/13056379?v=3","gravatar_id":"","url":"https://api.github.com/users/syldrathecat","html_url":"https://github.com/syldrathecat","followers_url":"https://api.github.com/users/syldrathecat/followers","following_url":"https://api.github.com/users/syldrathecat/following{/other_user}","gists_url":"https://api.github.com/users/syldrathecat/gists{/gist_id}","starred_url":"https://api.github.com/users/syldrathecat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/syldrathecat/subscriptions","organizations_url":"https://api.github.com/users/syldrathecat/orgs","repos_url":"https://api.github.com/users/syldrathecat/repos","events_url":"https://api.github.com/users/syldrathecat/events{/privacy}","received_events_url":"https://api.github.com/users/syldrathecat/received_events","type":"User","site_admin":false},"assignees":[{"login":"syldrathecat","id":13056379,"avatar_url":"https://avatars1.githubusercontent.com/u/13056379?v=3","gravatar_id":"","url":"https://api.github.com/users/syldrathecat","html_url":"https://github.com/syldrathecat","followers_url":"https://api.github.com/users/syldrathecat/followers","following_url":"https://api.github.com/users/syldrathecat/following{/other_user}","gists_url":"https://api.github.com/users/syldrathecat/gists{/gist_id}","starred_url":"https://api.github.com/users/syldrathecat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/syldrathecat/subscriptions","organizations_url":"https://api.github.com/users/syldrathecat/orgs","repos_url":"https://api.github.com/users/syldrathecat/repos","events_url":"https://api.github.com/users/syldrathecat/events{/privacy}","received_events_url":"https://api.github.com/users/syldrathecat/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2017-04-24T12:57:01Z","updated_at":"2017-04-24T12:57:01Z","closed_at":null,"body":"The downloaded configuration (`jav_config.ws`) allows specifying arbitrary file paths to download and save files to, potentially allowing for overwriting of any file the user has access to. The filenames should be stripped of any path components to contain the downloaded files to `~/Jagex/launcher/`\r\n\r\nThis is not really a huge security issue as the client, once running, generally has the same permissions, but this might help protect against unfortunate errors in the served configuration, or block one possible attack route in the case of an attacker able to serve their own configuration to the launcher (either via the web, or via overwriting the saved configuration used with the `--reuse` flag).\r\n\r\nIt may also become a security issue in the strange case that the launcher runs with permissions that won't be granted to the rs2client binary, either via system security configuration, or some kind of sand-boxing feature added to the launcher."}}
{"actor":{"display_login":"syldrathecat"}}