mirror of
https://github.com/ankitects/anki.git
synced 2026-09-10 08:39:22 -04:00
d4fdbefceb
## Linked issue (required) Closes #5167 ## Motivation The `.apkg` media uses `os.path.commonprefix`, which compares characters, not path components. A media filename resolving to a *sibling* directory that shares the media folder's name prefix passes the check, so a malicious `.apkg` can write outside `collection.media` (path traversal / arbitrary file write). A second commit removes the legacy importer entirely. The legacy import option was removed in #3536, leaving pylib/anki/importing, qt/aqt/importing.py and their dialog forms unreachable. The third commit removes the legacy exporter and adds a realpath check instead of the commonprefix. ## Steps to reproduce 1. Make an `.apkg` whose media maps a file into a sibling directory whose name begins with the media folder's name. 2. Import it. 3. Before: written outside `collection.media`. After: "Invalid file". ## Testing performed Tested by importing .apkg and .csv decks via File > Import on the main branch and on the PR branch. Cards import completes without problems. Also tested a deck and collection export with support to older Anki versions enabled. It works fine.