Preventing dangerous file names in tests config form.

Author: krulis-martin

src/components/forms/EditExerciseSimpleConfigForm/EditExerciseSimpleConfigForm.js

@@ -112,10 +112,26 @@ const validateFileExists = (data, errors, path, existingFiles) => {
   }
 };
 
-const validateFileEntryNotEmpty = (data, errors, path, emptyError) => {
+const validateFileName = (
+  data,
+  errors,
+  path,
+  emptyError = (
+    <FormattedMessage id="app.expandingInputFilesField.validateEmpty" defaultMessage="This value must not be empty." />
+  )
+) => {
   const name = safeGet(data, path);
   if (!name || name.trim() === '') {
     safeSet(errors, path, emptyError);
+  } else if (!name.match(/^[-a-zA-Z0-9_+.,@()%!# ]+$/) || name.trim() === '.' || name.trim() === '..') {
+    safeSet(
+      errors,
+      path,
+      <FormattedMessage
+        id="app.editExerciseConfigForm.validation.fileNameCharacters"
+        defaultMessage="File name must not contain dangerous characters (e.g. path separators)."
+      />
+    );
   }
 };
 
@@ -128,10 +144,10 @@ const validateFileList = (data, errors, path, pairs, existingFiles, emptyError,
   // check empty names
   files.forEach((_, idx) => {
     if (pairs) {
-      validateFileEntryNotEmpty(data, errors, [...path, idx, 'file'], emptyError);
-      validateFileEntryNotEmpty(data, errors, [...path, idx, 'name'], emptyError);
+      validateFileName(data, errors, [...path, idx, 'file'], emptyError);
+      validateFileName(data, errors, [...path, idx, 'name'], emptyError);
     } else {
-      validateFileEntryNotEmpty(data, errors, [...path, idx], emptyError);
+      validateFileName(data, errors, [...path, idx], emptyError);
     }
   });
 
@@ -412,6 +428,10 @@ const validate = (formData, { exercise, exerciseFiles }) => {
     if (test.useCustomJudge) {
       validateFileExists(formData, errors, ['config', testKey, 'custom-judge'], existingFiles);
     }
+
+    if (test.useOutFile) {
+      validateFileName(formData, errors, ['config', testKey, 'actual-output']);
+    }
   }
 
   return errors;

src/components/forms/EditExerciseSimpleConfigForm/EditExerciseSimpleConfigTest.js

@@ -66,7 +66,7 @@ class EditExerciseSimpleConfigTest extends Component {
       .find(env => Boolean(overrides[env]));
     const override = environmentWithOverride ? overrides[environmentWithOverride] : {};
 
-    // Prepare showFlags combining defaults with overrided for given environment
+    // Prepare showFlags combining defaults with overridden for given environment
     const {
       showCompilation = true, // compilation block (per-env extra files and entry points)
       showInputs = true, // input data module (input files + stdin)

src/pages/EditExerciseConfig/EditExerciseConfig.js

@@ -310,7 +310,7 @@ class EditExerciseConfig extends Component {
                     <table className="my-3">
                       <tbody>
                         <tr>
-                          <td className="valing-middle pe-3">
+                          <td className="pe-3">
                             <ResourceRenderer resource={[exerciseConfig, exerciseEnvironmentConfig]}>
                               {(config, environmentConfigs) => (
                                 <ResourceRenderer resourceArray={runtimeEnvironments}>