Validate Plugin Symlink Targets Before Replacing Existing Files

A symlink entry's target is now read and checked before anything already
at its destination is removed or renamed aside, so an archive rejected
for its link target leaves the installed plugin files in place.

src/libslic3r/Format/DRC.cpp

@@ -48,37 +48,24 @@ bool load_drc(const char *path, TriangleMesh *meshptr)
         indexed_triangle_set its;
 
         const PointAttribute *const positions = dracoMesh.GetNamedAttribute(GeometryAttribute::POSITION);
-        if (positions == nullptr) {
-            BOOST_LOG_TRIVIAL(error) << "load_drc: the mesh has no POSITION attribute";
-            return false;
-        }
         size_t num_vertices = positions->size();
         its.vertices.reserve(num_vertices);
         for (AttributeValueIndex i(0); i < num_vertices; ++ i) {
             float pos[3];
-            if (!positions->ConvertValue<float>(i, 3, pos)) {
-                BOOST_LOG_TRIVIAL(error) << "load_drc: invalid vertex position";
-                return false;
-            }
+            positions->ConvertValue<float>(i, 3, pos);
             its.vertices.emplace_back(pos[0], pos[1], pos[2]);
         }
 
-        // The Draco decoder does not check face indices against the point count.
-        const uint32_t num_points = dracoMesh.num_points();
         size_t num_faces = dracoMesh.num_faces();
         its.indices.reserve(num_faces);
         for (FaceIndex i(0); i < num_faces; ++ i) {
-            const Mesh::Face &face = dracoMesh.face(i);
-            stl_triangle_vertex_indices facet;
-            for (int k = 0; k < 3; ++ k) {
-                const size_t vertex_idx = face[k].value() < num_points ? positions->mapped_index(face[k]).value() : num_vertices;
-                if (vertex_idx >= num_vertices) {
-                    BOOST_LOG_TRIVIAL(error) << "load_drc: invalid vertex index";
-                    return false;
-                }
-                facet[k] = static_cast<int>(vertex_idx);
-            }
-            its.indices.emplace_back(facet);
+            Mesh::Face face = dracoMesh.face(i);
+
+            its.indices.emplace_back(
+                positions->mapped_index(face[0]).value(),
+                positions->mapped_index(face[1]).value(),
+                positions->mapped_index(face[2]).value()
+            );
         }
 
         *meshptr = TriangleMesh(std::move(its));

src/libslic3r/Format/OBJ.cpp

@@ -166,15 +166,10 @@ bool load_obj(const char *path, TriangleMesh *meshptr, ObjInfo& obj_info, std::s
                             obj_info.uv_map_pngs[face_index] = png_name;
                         }
                         if (data.textureCoordinates.size() > 0) {
-                            // A face vertex may omit vt or reference a missing one. Fall back to (0, 0) rather than
-                            // skipping the face, so obj_info.uvs stays aligned with the face indices.
-                            const int uv_count = static_cast<int>(data.textureCoordinates.size() / OBJ_TEXCOORD_LENGTH);
-                            auto      uv_at    = [&data, uv_count](int idx) -> Vec2f {
-                                if (idx < 0 || idx >= uv_count)
-                                    return Vec2f::Zero();
-                                return Vec2f(data.textureCoordinates[idx * OBJ_TEXCOORD_LENGTH], data.textureCoordinates[idx * OBJ_TEXCOORD_LENGTH + 1]);
-                            };
-                            std::array<Vec2f, 3> uv_array{uv_at(uvs[0]), uv_at(uvs[1]), uv_at(uvs[2])};
+                            Vec2f                uv0(data.textureCoordinates[uvs[0] * 2], data.textureCoordinates[uvs[0] * 2 + 1]);
+                            Vec2f                uv1(data.textureCoordinates[uvs[1] * 2], data.textureCoordinates[uvs[1] * 2 + 1]);
+                            Vec2f                uv2(data.textureCoordinates[uvs[2] * 2], data.textureCoordinates[uvs[2] * 2 + 1]);
+                            std::array<Vec2f, 3> uv_array{uv0, uv1, uv2};
                             obj_info.uvs.emplace_back(uv_array);
                         }
                         obj_info.face_colors.emplace_back(face_color);

src/libslic3r/Format/objparser.cpp

@@ -51,18 +51,19 @@ static bool obj_parseline(const char *line, ObjData &data)
 				line = endptr;
 				EATWS();
 			}
-			// The optional w is accepted but not stored: only u and v are used.
+			/*double w = 0;
 			if (*line != 0) {
-				strtod(line, &endptr);
+				w = strtod(line, &endptr);
 				if (endptr == 0 || (*endptr != ' ' && *endptr != '\t' && *endptr != 0))
 					return false;
 				line = endptr;
 				EATWS();
-			}
+			}*/
 			if (*line != 0)
 				return false;
 			data.textureCoordinates.push_back((float)u);
 			data.textureCoordinates.push_back((float)v);
+			//data.textureCoordinates.push_back((float)w);
 			break;
 		}
 		case 'n':
@@ -244,7 +245,7 @@ static bool obj_parseline(const char *line, ObjData &data)
             else
 				-- vertex.normalIdx;
 			if (vertex.textureCoordIdx < 0)
-                vertex.textureCoordIdx += (int)data.textureCoordinates.size() / OBJ_TEXCOORD_LENGTH;
+                vertex.textureCoordIdx += (int)data.textureCoordinates.size() / 3;
             else
 				-- vertex.textureCoordIdx;
 			data.vertices.push_back(vertex);

src/libslic3r/Format/objparser.hpp

@@ -92,7 +92,6 @@ inline bool operator==(const ObjSmoothingGroup &v1, const ObjSmoothingGroup &v2)
 }
 #define OBJ_VERTEX_COLOR_ALPHA 6
 #define OBJ_VERTEX_LENGTH   7  // x, y, z, color_x,color_y,color_z,color_w
-#define OBJ_TEXCOORD_LENGTH 2  // u, v
 #define ONE_FACE_SIZE 4//ONE_FACE format: f 8/4/6 7/3/6 6/2/6 -1/-1/-1
 struct ObjData {
 	// Version of the data structure for load / store in the private binary format.
@@ -101,7 +100,7 @@ struct ObjData {
 	// x, y, z, color_x,color_y,color_z,color_w
 	std::vector<float>				coordinates;
     bool                            has_vertex_color{false};
-	// u, v
+	// u, v, w
 	std::vector<float>				textureCoordinates;
 	// x, y, z
 	std::vector<float>				normals;

src/libslic3r/GCode.cpp

@@ -2504,8 +2504,7 @@ void GCode::do_export(Print* print, const char* path, GCodeProcessorResult* resu
 
     {
         LifecycleEventContext ctx;
-        ctx.id = std::to_string(print->model().id().id);
-        ctx.name = print->get_model_name();
+        ctx.name = std::to_string(print->model().id().id);
         ctx.code = LifecycleEvtCode::Ok;
         ctx.msg  = path;
         ctx.cancellation_check = [print]() { return print->canceled(); };
@@ -2557,8 +2556,7 @@ void GCode::do_export(Print* print, const char* path, GCodeProcessorResult* resu
         }
         {
             LifecycleEventContext ctx;
-            ctx.id = std::to_string(print->model().id().id);
-            ctx.name = print->get_model_name();
+            ctx.name = std::to_string(print->model().id().id);
             ctx.code = LifecycleEvtCode::Error;
             ctx.msg  = std::string(path) + "\n" + err_msg;
             ctx.cancellation_check = [print]() { return print->canceled(); };
@@ -2582,8 +2580,7 @@ void GCode::do_export(Print* print, const char* path, GCodeProcessorResult* resu
         boost::nowide::remove(path_tmp.c_str());
         {
             LifecycleEventContext ctx;
-            ctx.id = std::to_string(print->model().id().id);
-            ctx.name = print->get_model_name();
+            ctx.name = std::to_string(print->model().id().id);
             ctx.code = LifecycleEvtCode::Error;
             ctx.msg  = std::string(path) + "\n" + ex.what();
             ctx.cancellation_check = [print]() { return print->canceled(); };
@@ -2696,8 +2693,7 @@ void GCode::do_export(Print* print, const char* path, GCodeProcessorResult* resu
     if (ret) {
         {
             LifecycleEventContext ctx;
-            ctx.id = std::to_string(print->model().id().id);
-            ctx.name = print->get_model_name();
+            ctx.name = std::to_string(print->model().id().id);
             ctx.code = LifecycleEvtCode::Error;
             ctx.msg  = std::string(path) + "\nFailed to rename the output G-code file: " + ret.message();
             ctx.cancellation_check = [print]() { return print->canceled(); };
@@ -2716,8 +2712,7 @@ void GCode::do_export(Print* print, const char* path, GCodeProcessorResult* resu
 
     {
         LifecycleEventContext ctx;
-        ctx.id = std::to_string(print->model().id().id);
-        ctx.name = print->get_model_name();
+        ctx.name = std::to_string(print->model().id().id);
         ctx.code = LifecycleEvtCode::Ok;
         ctx.msg  = path;
         ctx.cancellation_check = [print]() { return print->canceled(); };

src/libslic3r/Print.cpp

@@ -2717,8 +2717,7 @@ void Print::process(long long *time_cost_with_cache, bool use_cache)
 
     {
         LifecycleEventContext ctx;
-        ctx.id = std::to_string(m_model.id().id);
-        ctx.name = get_model_name();
+        ctx.name = std::to_string(m_model.id().id);
         ctx.code = LifecycleEvtCode::Ok;
         ctx.cancellation_check = [this]() { return canceled(); };
         fire_lifecycle_event(LifecycleEvent::SliceStarted, ctx);
@@ -3345,8 +3344,7 @@ void Print::process(long long *time_cost_with_cache, bool use_cache)
 
     {
         LifecycleEventContext ctx;
-        ctx.id = std::to_string(m_model.id().id);
-        ctx.name = get_model_name();
+        ctx.name = std::to_string(m_model.id().id);
         ctx.code = LifecycleEvtCode::Ok;
         ctx.cancellation_check = [this]() { return canceled(); };
         fire_lifecycle_event(LifecycleEvent::SliceGeometryFinished, ctx);
@@ -4952,8 +4950,7 @@ void Print::export_gcode_from_previous_file(const std::string& file, GCodeProces
 {
     {
         LifecycleEventContext ctx;
-        ctx.id = std::to_string(m_model.id().id);
-        ctx.name = get_model_name();
+        ctx.name = std::to_string(m_model.id().id);
         ctx.code = LifecycleEvtCode::Ok;
         ctx.msg  = file;
         ctx.cancellation_check = [this]() { return canceled(); };
@@ -4983,8 +4980,7 @@ void Print::export_gcode_from_previous_file(const std::string& file, GCodeProces
         BOOST_LOG_TRIVIAL(error) << __FUNCTION__ <<  boost::format(": found errors when process gcode file %1%") %file.c_str();
         {
             LifecycleEventContext ctx;
-            ctx.id = std::to_string(m_model.id().id);
-            ctx.name = get_model_name();
+            ctx.name = std::to_string(m_model.id().id);
             ctx.code = LifecycleEvtCode::Error;
             ctx.msg  = file + "\n" + ex.what();
             ctx.cancellation_check = [this]() { return canceled(); };
@@ -4998,8 +4994,7 @@ void Print::export_gcode_from_previous_file(const std::string& file, GCodeProces
 
     {
         LifecycleEventContext ctx;
-        ctx.id = std::to_string(m_model.id().id);
-        ctx.name = get_model_name();
+        ctx.name = std::to_string(m_model.id().id);
         ctx.code = LifecycleEvtCode::Ok;
         ctx.msg  = file;
         ctx.cancellation_check = [this]() { return canceled(); };

src/libslic3r/Utils.hpp

@@ -260,6 +260,9 @@ extern bool is_json_file(const std::string& path);
 // Both '/' and '\\' are treated as separators on every platform, so an archive rejected on one OS
 // is rejected on all of them.
 extern bool is_path_within_root(const std::string &rel_path, const boost::filesystem::path &root);
+// True if a symlink stored at link_rel_path (relative to root) with this target stays inside root: the target
+// must be relative, and joined to the link's directory it must pass is_path_within_root.
+extern bool is_symlink_target_within_root(const std::string &link_rel_path, const std::string &target, const boost::filesystem::path &root);
 
 // Orca: custom protocal support utils
 inline bool is_orca_open(const std::string& url) { return boost::starts_with(url, "orcaslicer://open"); }

src/libslic3r/miniz_extension.cpp

@@ -4,6 +4,9 @@
 #include "miniz_extension.hpp"
 #include "Utils.hpp"
 
+#include <boost/filesystem.hpp>
+#include <boost/log/trivial.hpp>
+
 #if defined(_MSC_VER) || defined(__MINGW64__)
 #include "boost/nowide/cstdio.hpp"
 #endif
@@ -115,6 +118,66 @@ std::string decode_archive_entry_path(mz_zip_archive *zip, const mz_zip_archive_
     return decode_zip_unicode_path_extra_field(extra.substr(0, extra_size > 0 ? extra_size - 1 : 0), stat.m_filename);
 }
 
+bool extract_archive_confined(const std::string &zip_path_utf8, const std::string &dest_dir)
+{
+    mz_zip_archive archive;
+    mz_zip_zero_struct(&archive);
+
+    if (!open_zip_reader(&archive, zip_path_utf8)) {
+        BOOST_LOG_TRIVIAL(error) << "Unable to open zip reader for " << zip_path_utf8;
+        return false;
+    }
+
+    const mz_uint num_entries = mz_zip_reader_get_num_files(&archive);
+    mz_zip_archive_file_stat stat;
+
+    // Validate every entry first so an archive with a single escaping entry leaves no partial output behind.
+    const boost::filesystem::path root(dest_dir);
+    for (mz_uint i = 0; i < num_entries; ++i) {
+        if (mz_zip_reader_file_stat(&archive, i, &stat) && !is_path_within_root(stat.m_filename, root)) {
+            BOOST_LOG_TRIVIAL(error) << "Unzip: rejecting " << zip_path_utf8 << ", entry " << stat.m_filename << " resolves outside " << dest_dir;
+            close_zip_reader(&archive);
+            return false;
+        }
+    }
+
+    for (mz_uint i = 0; i < num_entries; ++i) {
+        if (!mz_zip_reader_file_stat(&archive, i, &stat)) {
+            BOOST_LOG_TRIVIAL(warning) << "Unzip: read file stat failed";
+            continue;
+        }
+        const std::string dest_file = dest_dir + "/" + stat.m_filename;
+        try {
+            if (stat.m_is_directory) {
+                const boost::filesystem::path dest_path(dest_file);
+                if (!boost::filesystem::exists(dest_path))
+                    boost::filesystem::create_directories(dest_path);
+                continue;
+            }
+            if (stat.m_uncomp_size == 0) {
+                BOOST_LOG_TRIVIAL(warning) << "Unzip: invalid size for file " << stat.m_filename;
+                continue;
+            }
+            // Replace a symlink at the destination rather than writing through it.
+            const boost::filesystem::path dest_path(dest_file);
+            if (boost::filesystem::is_symlink(boost::filesystem::symlink_status(dest_path)))
+                boost::filesystem::remove(dest_path);
+            if (!mz_zip_reader_extract_to_file(&archive, stat.m_file_index, dest_file.c_str(), 0)) {
+                BOOST_LOG_TRIVIAL(error) << "Unzip: extract file " << stat.m_filename << " to dest " << dest_file << " failed";
+                close_zip_reader(&archive);
+                return false;
+            }
+            BOOST_LOG_TRIVIAL(info) << "Unzip: successfully extract file " << stat.m_file_index << " to " << dest_file;
+        } catch (const std::exception &e) {
+            close_zip_reader(&archive);
+            BOOST_LOG_TRIVIAL(error) << "Unzip: archive read exception: " << e.what();
+            return false;
+        }
+    }
+    close_zip_reader(&archive);
+    return true;
+}
+
 MZ_Archive::MZ_Archive()
 {
     mz_zip_zero_struct(&arch);

src/libslic3r/miniz_extension.hpp

@@ -11,6 +11,8 @@ bool open_zip_writer(mz_zip_archive *zip, const std::string &fname_utf8);
 bool close_zip_reader(mz_zip_archive *zip);
 bool close_zip_writer(mz_zip_archive *zip);
 std::string decode_archive_entry_path(mz_zip_archive *zip, const mz_zip_archive_file_stat &stat);
+// Extracts every entry of the archive under dest_dir. Nothing is written if any entry would resolve outside dest_dir.
+bool extract_archive_confined(const std::string &zip_path_utf8, const std::string &dest_dir);
 
 class MZ_Archive {
 public:

src/libslic3r/utils.cpp

@@ -1103,7 +1103,10 @@ bool is_path_within_root(const std::string &rel_path, const boost::filesystem::p
     }
     // Resolve against the canonical root so a symlink inside it cannot lead back out.
     try {
-        const std::string root_str = boost::filesystem::weakly_canonical(root).string();
+        std::string root_str = boost::filesystem::weakly_canonical(root).string();
+        // A trailing separator on root would otherwise fail the prefix match below for every path.
+        while (!root_str.empty() && (root_str.back() == '/' || root_str.back() == boost::filesystem::path::preferred_separator))
+            root_str.pop_back();
         const std::string full_str = boost::filesystem::weakly_canonical(root / rel_path).string();
         return full_str.compare(0, root_str.size(), root_str) == 0 &&
                (full_str.size() == root_str.size() || full_str[root_str.size()] == boost::filesystem::path::preferred_separator);
@@ -1112,6 +1115,15 @@ bool is_path_within_root(const std::string &rel_path, const boost::filesystem::p
     }
 }
 
+bool is_symlink_target_within_root(const std::string &link_rel_path, const std::string &target, const boost::filesystem::path &root)
+{
+    if (target.empty() || target.front() == '/' || target.front() == '\\' || (target.size() > 1 && target[1] == ':'))
+        return false;
+    // A relative target without ".." only descends from the link's directory, so no chain of such links can leave root.
+    const size_t sep = link_rel_path.find_last_of("/\\");
+    return is_path_within_root((sep == std::string::npos ? std::string() : link_rel_path.substr(0, sep + 1)) + target, root);
+}
+
 bool is_img_file(const std::string &path)
 {
 	return boost::iends_with(path, ".png") || boost::iends_with(path, ".svg");

src/slic3r/GUI/GUI_App.cpp

@@ -1512,11 +1512,33 @@ int GUI_App::install_plugin(std::string name, std::string package_name, InstallP
                     size_t n = mz_zip_reader_get_extra(&archive, stat.m_file_index, extra.data(), extra.size());
                     dest_file = decode(extra.substr(0, n), stat.m_filename);
                 }
+                if (!is_path_within_root(dest_file, plugin_folder)) {
+                    BOOST_LOG_TRIVIAL(error) << "[install_plugin] entry " << dest_file << " resolves outside " << plugin_folder.string();
+                    close_zip_reader(&archive);
+                    if (pro_fn) { pro_fn(InstallStatusUnzipFailed, 0, cancel); }
+                    return InstallStatusUnzipFailed;
+                }
                 auto dest_path = plugin_folder / dest_file;
-                boost::filesystem::create_directories(dest_path.parent_path());
                 std::string dest_zip_file = encode_path(dest_path.string().c_str());
+#ifndef WIN32
+                // Validate a symlink's target before anything at the destination is replaced.
+                const bool is_link = S_ISLNK(stat.m_external_attr >> 16);
+                std::string link;
+                if (is_link) {
+                    link.assign(stat.m_uncomp_size, 0);
+                    if (!mz_zip_reader_extract_to_mem(&archive, stat.m_file_index, link.data(), stat.m_uncomp_size, 0) ||
+                        !is_symlink_target_within_root(dest_file, link, plugin_folder)) {
+                        BOOST_LOG_TRIVIAL(error) << "[install_plugin] link " << dest_file << " -> " << link << " is unreadable or resolves outside " << plugin_folder.string();
+                        close_zip_reader(&archive);
+                        if (pro_fn) { pro_fn(InstallStatusUnzipFailed, 0, cancel); }
+                        return InstallStatusUnzipFailed;
+                    }
+                }
+#endif
                 try {
-                    if (fs::exists(dest_path)) {
+                    boost::filesystem::create_directories(dest_path.parent_path());
+                    // symlink_status so that an existing symlink, dangling or not, is replaced rather than written through.
+                    if (fs::exists(fs::symlink_status(dest_path))) {
                         boost::system::error_code ec;
                         fs::remove(dest_path, ec);
                         if (ec) {
@@ -1544,9 +1566,8 @@ int GUI_App::install_plugin(std::string name, std::string package_name, InstallP
                     }
                     mz_bool res = 0;
 #ifndef WIN32
-                    if (S_ISLNK(stat.m_external_attr >> 16)) {
-                        std::string link(stat.m_uncomp_size + 1, 0);
-                        res = mz_zip_reader_extract_to_mem(&archive, stat.m_file_index, link.data(), stat.m_uncomp_size, 0);
+                    if (is_link) {
+                        res = 1;
                         try {
                             boost::filesystem::create_symlink(link, dest_path);
                         } catch (const std::exception &e) {

src/slic3r/GUI/Plater.cpp

@@ -12800,6 +12800,8 @@ void Plater::priv::on_process_completed(SlicingProcessCompletedEvent &evt)
     notification_manager->set_slicing_progress_export_possible();
 
     // Reset the "export G-code path" name, so that the automatic background processing will be enabled again.
+    const std::string lifecycle_job_name = this->background_process.fff_print() ?
+        this->background_process.fff_print()->output_filename() : std::string();
     this->background_process.reset_export();
     // This bool stops showing export finished notification even when process_completed_with_error is false
     bool has_error = false;
@@ -12846,18 +12848,8 @@ void Plater::priv::on_process_completed(SlicingProcessCompletedEvent &evt)
 
     {
         Slic3r::LifecycleEventContext ctx;
-        if (const PrintBase* print = this->background_process.current_print()) {
-            const Model& model = print->model();
-            ctx.id             = std::to_string(model.id().id);
-            if (model.model_info)
-                ctx.name = model.model_info->model_name;
-        } else {
-            // Realistically Printbase* print will never be null because select_technology already asserts an active print
-            // and the worker thread asserts it before processing.
-            BOOST_LOG_TRIVIAL(warning) << __FUNCTION__ << ": slicing completed without an active print; lifecycle event has no model ID";
-        }
-        ctx.code = evt.cancelled() ? Slic3r::LifecycleEvtCode::Warn :
-                                     (has_error ? Slic3r::LifecycleEvtCode::Error : Slic3r::LifecycleEvtCode::Ok);
+        ctx.name = lifecycle_job_name;
+        ctx.code = evt.cancelled() ? Slic3r::LifecycleEvtCode::Warn : (has_error ? Slic3r::LifecycleEvtCode::Error : Slic3r::LifecycleEvtCode::Ok);
         ctx.msg  = evt.cancelled() ? "cancelled" : (has_error ? lifecycle_error_msg : std::string());
         Slic3r::fire_lifecycle_event(Slic3r::LifecycleEvent::SlicingJobComplete, ctx);
     }

src/slic3r/Utils/PresetUpdater.cpp

@@ -339,62 +339,8 @@ bool PresetUpdater::priv::get_file(const std::string &url, const fs::path &targe
 //BBS: refine preset update logic
 bool PresetUpdater::priv::extract_file(const fs::path &source_path, const fs::path &dest_path)
 {
-    bool res = true;
-    std::string file_path = source_path.string();
-    std::string parent_path = (!dest_path.empty() ? dest_path : source_path.parent_path()).string();
-    mz_zip_archive archive;
-    mz_zip_zero_struct(&archive);
-
-    if (!open_zip_reader(&archive, file_path))
-    {
-        BOOST_LOG_TRIVIAL(error) << "Unable to open zip reader for "<<file_path;
-        return false;
-    }
-
-    mz_uint num_entries = mz_zip_reader_get_num_files(&archive);
-
-    mz_zip_archive_file_stat stat;
-    // we first loop the entries to read from the archive the .amf file only, in order to extract the version from it
-    for (mz_uint i = 0; i < num_entries; ++i)
-    {
-        if (mz_zip_reader_file_stat(&archive, i, &stat))
-        {
-            std::string dest_file = parent_path+"/"+stat.m_filename;
-            if (stat.m_is_directory) {
-                fs::path dest_path(dest_file);
-                if (!fs::exists(dest_path))
-                    fs::create_directories(dest_path);
-				continue;
-            }
-            else if (stat.m_uncomp_size == 0) {
-                BOOST_LOG_TRIVIAL(warning) << "[Orca Updater]Unzip: invalid size for file "<<stat.m_filename;
-                continue;
-            }
-            try
-            {
-                res = mz_zip_reader_extract_to_file(&archive, stat.m_file_index, dest_file.c_str(), 0);
-                if (!res) {
-                    BOOST_LOG_TRIVIAL(error) << "[Orca Updater]extract file "<<stat.m_filename<<" to dest "<<dest_file<<" failed";
-                    close_zip_reader(&archive);
-                    return res;
-                }
-                BOOST_LOG_TRIVIAL(info) << "[Orca Updater]successfully extract file " << stat.m_file_index << " to "<<dest_file;
-            }
-            catch (const std::exception& e)
-            {
-                // ensure the zip archive is closed and rethrow the exception
-                close_zip_reader(&archive);
-                BOOST_LOG_TRIVIAL(error) << "[Orca Updater]Archive read exception:"<<e.what();
-                return false;
-            }
-        }
-        else {
-            BOOST_LOG_TRIVIAL(warning) << "[Orca Updater]Unzip: read file stat failed";
-        }
-    }
-    close_zip_reader(&archive);
-
-	return true;
+    const std::string parent_path = (!dest_path.empty() ? dest_path : source_path.parent_path()).string();
+    return extract_archive_confined(source_path.string(), parent_path);
 }
 
 // Remove a leftover partial archive for the vendor about to be synchronized.

src/slic3r/Utils/PrintHost.cpp

@@ -6,7 +6,6 @@
 #include <boost/optional.hpp>
 #include <boost/log/trivial.hpp>
 #include <boost/filesystem.hpp>
-#include <nlohmann/json.hpp>
 
 #include <wx/string.h>
 #include <wx/app.h>
@@ -116,67 +115,10 @@ std::string PrintHost::get_print_host_webui(DynamicPrintConfig* config)
     return webui_url;
 }
 
-namespace {
-
-// Moonraker (Klipper's API server) reports a raised exception as { "error": { "code", "message", "traceback" } }
-// under every host type that connects to it, often with the cause only in the traceback. Returns the reason to show,
-// or empty for any other body.
-std::string moonraker_error_reason(const std::string &body)
-{
-    const auto root = nlohmann::json::parse(body, nullptr, false);
-    const auto err  = root.find("error");
-    if (err == root.end())
-        return {};
-    const auto message   = err->find("message");
-    const auto traceback = err->find("traceback");
-    if (message == err->end() || traceback == err->end() || !message->is_string() || !traceback->is_string())
-        return {};
-
-    const auto &msg = message->get_ref<const std::string &>();
-    const auto &tb  = traceback->get_ref<const std::string &>();
-    if (msg.empty())
-        return {};
-    const auto end = tb.find_last_not_of(" \t\r\n");
-    if (end == std::string::npos)
-        return msg;
-
-    // Chained exceptions each start a new traceback; the one that failed the request is the last.
-    const auto header = tb.rfind("Traceback (most recent call last):", end);
-
-    // Tornado renders a raised HTTPError as "HTTP <code>: <reason>[ (<detail>)]", and the detail may span lines.
-    const auto code = err->find("code");
-    if (code != err->end() && code->is_number_integer()) {
-        const std::string marker = "HTTP " + std::to_string(code->get<int>()) + ": ";
-        const auto        pos    = tb.rfind(marker, end);
-        if (pos != std::string::npos && (header == std::string::npos || pos > header) && pos + marker.size() <= end) {
-            const std::string reason = tb.substr(pos + marker.size(), end + 1 - pos - marker.size());
-            // An HTTPError whose detail equals its reason, like HTTPError(401, "Unauthorized"), renders the phrase twice.
-            return reason == msg + " (" + msg + ")" ? msg : reason;
-        }
-    }
-
-    // Any other exception's type and message are everything from the first unindented line after its frames.
-    auto begin = (header == std::string::npos) ? std::string::npos : tb.find('\n', header);
-    while (begin != std::string::npos && begin < end) {
-        ++begin;
-        if (tb[begin] != ' ' && tb[begin] != '\r' && tb[begin] != '\n')
-            break;
-        begin = tb.find('\n', begin);
-    }
-    if (begin == std::string::npos || begin > end) {
-        const auto nl = tb.rfind('\n', end);
-        begin         = (nl == std::string::npos) ? 0 : nl + 1;
-    }
-    return msg + " (" + tb.substr(begin, end + 1 - begin) + ")";
-}
-
-} // namespace
-
 wxString PrintHost::format_error(const std::string &body, const std::string &error, unsigned status) const
 {
     if (status != 0) {
-        const std::string reason = moonraker_error_reason(body);
-        auto wxbody = wxString::FromUTF8(reason.empty() ? body : reason);
+        auto wxbody = wxString::FromUTF8(body.data());
         return wxString::Format("HTTP %u: %s", status, wxbody);
     } else {
         if (error.find("curl:Timeout was reached") != std::string::npos) {

tests/fff_print/test_print.cpp

@@ -15,9 +15,6 @@
 #include "libslic3r/Layer.hpp"
 #include "libslic3r/Model.hpp"
 #include "libslic3r/GCodeReader.hpp"
-#include "libslic3r/GCode/GCodeProcessor.hpp"
-#include "libslic3r/Exception.hpp"
-#include "libslic3r/LifecycleEvents.hpp"
 
 #include "test_helpers.hpp"
 #include "test_utils.hpp"
@@ -25,10 +22,7 @@
 #include <algorithm>
 #include <fstream>
 #include <iterator>
-#include <memory>
 #include <string_view>
-#include <utility>
-#include <vector>
 
 using namespace Slic3r;
 using namespace Slic3r::Test;
@@ -230,88 +224,8 @@ std::string resolved_output_name(Model& model, const std::string& format, const
     return print.output_filename(filename_base);
 }
 
-struct ScopedLifecycleHook
-{
-    explicit ScopedLifecycleHook(LifecycleHookFn hook) { set_lifecycle_hook_fn(std::move(hook)); }
-    ~ScopedLifecycleHook() { set_lifecycle_hook_fn(nullptr); }
-};
-
 } // namespace
 
-TEST_CASE("Slicing lifecycle events identify the model", "[Print][LifecycleEvents]")
-{
-    struct ObservedEvent {
-        LifecycleEvent event;
-        std::string id;
-        std::string name;
-    };
-    std::vector<ObservedEvent> events;
-    ScopedLifecycleHook hook([&](LifecycleEvent event, const LifecycleEventContext& ctx) {
-        events.push_back({ event, ctx.id, ctx.name });
-    });
-
-    Print print;
-    Model model;
-    ModelInfo info;
-    info.model_name = "Lifecycle test model";
-    model.model_info = std::make_shared<ModelInfo>(std::move(info));
-    init_print({cube(20)}, print, model);
-
-    print.process();
-    ScopedTemporaryFile temp(".gcode");
-    print.export_gcode(temp.string(), nullptr, nullptr);
-    GCodeProcessorResult result;
-    print.export_gcode_from_previous_file(temp.string(), &result);
-
-    const std::string expected_id = std::to_string(print.model().id().id);
-    const std::vector<LifecycleEvent> expected_events = {
-        LifecycleEvent::SliceStarted,
-        LifecycleEvent::SliceGeometryFinished,
-        LifecycleEvent::GCodeExportStarted,
-        LifecycleEvent::GCodeExportFinished,
-        LifecycleEvent::GCodeExportStarted,
-        LifecycleEvent::GCodeExportFinished,
-    };
-    REQUIRE(events.size() == expected_events.size());
-    for (size_t i = 0; i < expected_events.size(); ++i) {
-        CHECK(events[i].event == expected_events[i]);
-        CHECK(events[i].id == expected_id);
-        CHECK(events[i].name == "Lifecycle test model");
-    }
-}
-
-TEST_CASE("Slicing lifecycle event name is empty without model metadata", "[Print][LifecycleEvents]")
-{
-    std::string event_id;
-    std::string event_name = "unset";
-    ScopedLifecycleHook hook([&](LifecycleEvent event, const LifecycleEventContext& ctx) {
-        if (event == LifecycleEvent::SliceStarted) {
-            event_id = ctx.id;
-            event_name = ctx.name;
-        }
-    });
-
-    Print print;
-    Model model;
-    init_print({cube(20)}, print, model);
-    print.process();
-
-    CHECK(event_id == std::to_string(print.model().id().id));
-    CHECK(event_name.empty());
-}
-
-TEST_CASE("Output filenames with numeric statistics fail before slicing finishes", "[Print][Regression]")
-{
-    DynamicPrintConfig config = DynamicPrintConfig::full_print_config();
-    config.set_key_value("filename_format", new ConfigOptionString("{int(total_weight*10) / 10.0}"));
-
-    Print print;
-    Model model;
-    init_print({cube(20)}, print, model, config);
-
-    CHECK_THROWS_AS(print.output_filename(), PlaceholderParserError);
-}
-
 TEST_CASE("Print: {first_object_name} names the first printable object on the plate", "[Print]")
 {
     Model model;

tests/libslic3r/CMakeLists.txt

@@ -14,7 +14,6 @@ add_executable(${_TEST_NAME}_tests
     test_clipper_utils.cpp
     test_config.cpp
     test_config_variant_expansion.cpp
-    test_drc.cpp
     test_toolordering_nozzle_group.cpp
     test_preset_bundle_loading.cpp
     test_preset_setting_id.cpp
@@ -33,7 +32,6 @@ add_executable(${_TEST_NAME}_tests
     test_mutable_priority_queue.cpp
     test_minimum_spanning_tree.cpp
     test_nozzle_volume_type.cpp
-    test_obj.cpp
     test_step.cpp
     test_stl.cpp
     test_triangle_selector.cpp
@@ -42,6 +40,7 @@ add_executable(${_TEST_NAME}_tests
     test_lay_on_face.cpp
     test_model.cpp
     test_utils.cpp
+    test_miniz_extension.cpp
     test_timeutils.cpp
     test_voronoi.cpp
     test_wipe_tower_estimate.cpp
@@ -69,9 +68,7 @@ if (TARGET OpenVDB::openvdb)
     target_sources(${_TEST_NAME}_tests PRIVATE test_hollowing.cpp)
 endif()
 
-# libslic3r links Draco privately; test_drc.cpp encodes its own fixtures.
-find_package(Draco REQUIRED)
-target_link_libraries(${_TEST_NAME}_tests test_common libslic3r draco::draco Catch2::Catch2WithMain)
+target_link_libraries(${_TEST_NAME}_tests test_common libslic3r Catch2::Catch2WithMain)
 target_include_directories(${_TEST_NAME}_tests PRIVATE ${CMAKE_SOURCE_DIR}/src)
 set_property(TARGET ${_TEST_NAME}_tests PROPERTY FOLDER "tests")
 

tests/libslic3r/test_drc.cpp

@@ -1,71 +0,0 @@
-#include <catch2/catch_all.hpp>
-
-#include "libslic3r/Format/DRC.hpp"
-#include "libslic3r/TriangleMesh.hpp"
-
-#include <boost/nowide/fstream.hpp>
-
-#include <draco/compression/encode.h>
-#include <draco/mesh/mesh.h>
-
-#include "test_utils.hpp"
-
-using namespace Slic3r;
-
-namespace {
-
-// Encodes one triangle whose vertices carry a single attribute of the given type.
-// The decoder accepts both a mesh without POSITION and a face index past the point count.
-void write_drc_triangle(const std::string &path, draco::GeometryAttribute::Type attribute_type, uint32_t second_point)
-{
-    draco::Mesh mesh;
-    mesh.set_num_points(3);
-    draco::GeometryAttribute attribute;
-    attribute.Init(attribute_type, nullptr, 3, draco::DT_FLOAT32, false, sizeof(float) * 3, 0);
-    const int attribute_id = mesh.AddAttribute(attribute, true, 3);
-    const float points[3][3] = {{0, 0, 0}, {1, 0, 0}, {0, 1, 0}};
-    for (int i = 0; i < 3; ++i)
-        mesh.attribute(attribute_id)->SetAttributeValue(draco::AttributeValueIndex(i), points[i]);
-    draco::Mesh::Face face;
-    face[0] = draco::PointIndex(0);
-    face[1] = draco::PointIndex(second_point);
-    face[2] = draco::PointIndex(2);
-    mesh.AddFace(face);
-
-    draco::Encoder encoder;
-    encoder.SetEncodingMethod(draco::MESH_SEQUENTIAL_ENCODING);
-    draco::EncoderBuffer buffer;
-    REQUIRE(encoder.EncodeMeshToBuffer(mesh, &buffer).ok());
-    boost::nowide::ofstream out(path, std::ios::binary);
-    out.write(buffer.data(), static_cast<std::streamsize>(buffer.size()));
-}
-
-} // namespace
-
-TEST_CASE("A Draco triangle with positions loads", "[DRC]")
-{
-    ScopedTemporaryFile drc(".drc");
-    write_drc_triangle(drc.string(), draco::GeometryAttribute::POSITION, 1);
-
-    TriangleMesh mesh;
-    REQUIRE(load_drc(drc.string().c_str(), &mesh));
-    CHECK(mesh.facets_count() == 1);
-}
-
-TEST_CASE("A Draco mesh without a POSITION attribute fails to load", "[DRC][Regression]")
-{
-    ScopedTemporaryFile drc(".drc");
-    write_drc_triangle(drc.string(), draco::GeometryAttribute::GENERIC, 1);
-
-    TriangleMesh mesh;
-    CHECK_FALSE(load_drc(drc.string().c_str(), &mesh));
-}
-
-TEST_CASE("A Draco face referencing a missing point fails to load", "[DRC][Regression]")
-{
-    ScopedTemporaryFile drc(".drc");
-    write_drc_triangle(drc.string(), draco::GeometryAttribute::POSITION, 200);
-
-    TriangleMesh mesh;
-    CHECK_FALSE(load_drc(drc.string().c_str(), &mesh));
-}

tests/libslic3r/test_miniz_extension.cpp

@@ -0,0 +1,194 @@
+#include <catch2/catch_all.hpp>
+
+#include "libslic3r/miniz_extension.hpp"
+
+#include "test_utils.hpp"
+
+#include <boost/filesystem.hpp>
+
+#include <algorithm>
+#include <fstream>
+#include <iterator>
+#include <string>
+#include <utility>
+#include <vector>
+
+using namespace Slic3r;
+namespace fs = boost::filesystem;
+
+namespace {
+
+void write_zip(const fs::path &zip_file, const std::vector<std::pair<std::string, std::string>> &entries)
+{
+    mz_zip_archive zip;
+    mz_zip_zero_struct(&zip);
+    REQUIRE(open_zip_writer(&zip, zip_file.string()));
+    for (const auto &[name, content] : entries)
+        REQUIRE(mz_zip_writer_add_mem(&zip, name.c_str(), content.data(), content.size(), MZ_DEFAULT_COMPRESSION));
+    REQUIRE(mz_zip_writer_finalize_archive(&zip));
+    REQUIRE(close_zip_writer(&zip));
+}
+
+// miniz refuses to write a name starting with '/', so write a placeholder of the same length and patch it in place.
+void rename_entry(const fs::path &zip_file, const std::string &from, const std::string &to)
+{
+    REQUIRE(from.size() == to.size());
+    std::string bytes;
+    {
+        std::ifstream in(zip_file.string(), std::ios::binary);
+        bytes.assign(std::istreambuf_iterator<char>(in), std::istreambuf_iterator<char>());
+    }
+    size_t count = 0;
+    for (size_t pos = bytes.find(from); pos != std::string::npos; pos = bytes.find(from, pos + to.size()), ++count)
+        bytes.replace(pos, from.size(), to);
+    // Once in the local header and once in the central directory.
+    REQUIRE(count == 2);
+    std::ofstream out(zip_file.string(), std::ios::binary | std::ios::trunc);
+    out << bytes;
+}
+
+std::vector<std::string> list_dir(const fs::path &dir)
+{
+    std::vector<std::string> names;
+    for (const fs::directory_entry &entry : fs::directory_iterator(dir))
+        names.push_back(entry.path().filename().string());
+    std::sort(names.begin(), names.end());
+    return names;
+}
+
+std::string read_file(const fs::path &file)
+{
+    std::ifstream in(file.string(), std::ios::binary);
+    return std::string(std::istreambuf_iterator<char>(in), std::istreambuf_iterator<char>());
+}
+
+} // namespace
+
+TEST_CASE("Confined extraction writes a well-formed archive under the target directory", "[MinizExtension]")
+{
+    ScopedTemporaryDir tmp;
+    const fs::path     zip_file = tmp.path() / "bundle.zip";
+    const fs::path     target   = tmp.path() / "cache";
+    fs::create_directories(target);
+    write_zip(zip_file, {{"vendor/", ""}, {"vendor/machine/", ""}, {"vendor.json", "{\"a\":1}"}, {"vendor/machine/printer.json", "{\"b\":2}"}});
+
+    REQUIRE(extract_archive_confined(zip_file.string(), target.string()));
+    CHECK(fs::is_directory(target / "vendor"));
+    CHECK(read_file(target / "vendor.json") == "{\"a\":1}");
+    CHECK(read_file(target / "vendor" / "machine" / "printer.json") == "{\"b\":2}");
+}
+
+TEST_CASE("Confined extraction rejects an archive with an entry outside the target directory", "[MinizExtension]")
+{
+    ScopedTemporaryDir tmp;
+    const fs::path     zip_file = tmp.path() / "bundle.zip";
+    const fs::path     target   = tmp.path() / "cache";
+    fs::create_directories(target);
+
+    const std::string escaping_entry = GENERATE(std::string("../escape.txt"), std::string("..\\escape.txt"),
+                                                std::string("sub/../../escape.txt"), std::string("C:/escape.txt"),
+                                                std::string("C:escape.txt"), std::string("\\escape.txt"));
+    // The normal entry comes first so a per-entry check would already have written it.
+    write_zip(zip_file, {{"normal.json", "{}"}, {escaping_entry, "escaped"}});
+
+    CAPTURE(escaping_entry);
+    CHECK_FALSE(extract_archive_confined(zip_file.string(), target.string()));
+    CHECK_FALSE(fs::exists(tmp.path() / "escape.txt"));
+    CHECK(fs::is_empty(target));
+}
+
+TEST_CASE("Confined extraction rejects an archive with an absolute entry name", "[MinizExtension]")
+{
+    ScopedTemporaryDir tmp;
+    const fs::path     zip_file = tmp.path() / "bundle.zip";
+    const fs::path     target   = tmp.path() / "cache";
+    fs::create_directories(target);
+
+    const std::string absolute    = (tmp.path() / "escape.txt").generic_string();
+    const std::string placeholder = "#" + absolute.substr(1);
+    write_zip(zip_file, {{"normal.json", "{}"}, {placeholder, "escaped"}});
+    rename_entry(zip_file, placeholder, absolute);
+
+    CHECK_FALSE(extract_archive_confined(zip_file.string(), target.string()));
+    CHECK_FALSE(fs::exists(tmp.path() / "escape.txt"));
+    CHECK(fs::is_empty(target));
+}
+
+TEST_CASE("Confined extraction rejects a directory entry outside the target directory", "[MinizExtension]")
+{
+    ScopedTemporaryDir tmp;
+    const fs::path     zip_file = tmp.path() / "bundle.zip";
+    const fs::path     target   = tmp.path() / "cache";
+    fs::create_directories(target);
+    write_zip(zip_file, {{"vendor/", ""}, {"../outside/", ""}});
+
+    CHECK_FALSE(extract_archive_confined(zip_file.string(), target.string()));
+    CHECK_FALSE(fs::exists(tmp.path() / "outside"));
+    CHECK(fs::is_empty(target));
+}
+
+TEST_CASE("Confined extraction validates zero-size entries like any other", "[MinizExtension]")
+{
+    ScopedTemporaryDir tmp;
+    const fs::path     zip_file = tmp.path() / "bundle.zip";
+    const fs::path     target   = tmp.path() / "cache";
+    fs::create_directories(target);
+
+    SECTION("an empty file inside the target does not fail the archive") {
+        write_zip(zip_file, {{"empty.json", ""}, {"vendor.json", "{}"}});
+        CHECK(extract_archive_confined(zip_file.string(), target.string()));
+        CHECK(read_file(target / "vendor.json") == "{}");
+    }
+    SECTION("an empty file outside the target rejects the archive") {
+        write_zip(zip_file, {{"vendor.json", "{}"}, {"../escape.txt", ""}});
+        CHECK_FALSE(extract_archive_confined(zip_file.string(), target.string()));
+        CHECK_FALSE(fs::exists(tmp.path() / "escape.txt"));
+        CHECK(fs::is_empty(target));
+    }
+}
+
+TEST_CASE("Confined extraction writes nothing outside the target for Windows-specific name forms", "[MinizExtension]")
+{
+    ScopedTemporaryDir tmp;
+    const fs::path     zip_file = tmp.path() / "bundle.zip";
+    const fs::path     target   = tmp.path() / "cache";
+    fs::create_directories(target);
+
+    // Windows strips trailing dots and spaces and maps device names; whether these extract depends on the
+    // platform, but none of them may land beside the target.
+    const std::string name = GENERATE(std::string("name."), std::string("name "), std::string("..."), std::string(".. "),
+                                      std::string(".. /escape.txt"), std::string(".../escape.txt"), std::string("CON"),
+                                      std::string("sub/NUL.txt"), std::string("C:escape.txt"));
+    write_zip(zip_file, {{name, "payload"}});
+
+    CAPTURE(name);
+    extract_archive_confined(zip_file.string(), target.string());
+    CHECK(list_dir(tmp.path()) == std::vector<std::string>{"bundle.zip", "cache"});
+}
+
+#ifndef _WIN32
+TEST_CASE("Confined extraction replaces a symlink at the destination instead of writing through it", "[MinizExtension]")
+{
+    ScopedTemporaryDir tmp;
+    const fs::path     zip_file = tmp.path() / "bundle.zip";
+    const fs::path     target   = tmp.path() / "cache";
+    const fs::path     outside  = tmp.path() / "outside";
+    fs::create_directories(target);
+    fs::create_directories(outside);
+    write_zip(zip_file, {{"vendor.json", "{\"a\":1}"}});
+
+    SECTION("a dangling symlink") {
+        fs::create_symlink(outside / "vendor.json", target / "vendor.json");
+        CHECK(extract_archive_confined(zip_file.string(), target.string()));
+        CHECK_FALSE(fs::exists(outside / "vendor.json"));
+        CHECK_FALSE(fs::is_symlink(fs::symlink_status(target / "vendor.json")));
+        CHECK(read_file(target / "vendor.json") == "{\"a\":1}");
+    }
+    SECTION("a symlink to an existing file") {
+        { std::ofstream((outside / "vendor.json").string()) << "original"; }
+        fs::create_symlink(outside / "vendor.json", target / "vendor.json");
+        extract_archive_confined(zip_file.string(), target.string());
+        CHECK(read_file(outside / "vendor.json") == "original");
+    }
+}
+#endif

tests/libslic3r/test_obj.cpp

@@ -1,122 +0,0 @@
-#include <catch2/catch_all.hpp>
-
-#include "libslic3r/TriangleMesh.hpp"
-#include "libslic3r/Format/OBJ.hpp"
-
-#include <boost/nowide/fstream.hpp>
-
-#include "test_utils.hpp"
-
-using namespace Slic3r;
-using Catch::Matchers::WithinAbs;
-
-namespace {
-
-struct LoadedObj
-{
-    bool         ok{false};
-    TriangleMesh mesh;
-    ObjInfo      info;
-};
-
-// A tetrahedron with a material and two texture coordinates, (0.25, 0.5) and (0.75, 1).
-// Only the first face and the vt lines are varied; the other three faces reference vt 1.
-LoadedObj load_textured_tetrahedron(const std::string &first_face, const std::string &vts = "vt 0.25 0.5\nvt 0.75 1\n")
-{
-    ScopedTemporaryFile obj(".obj");
-    ScopedTemporaryFile mtl(".mtl");
-    {
-        boost::nowide::ofstream out(mtl.string());
-        out << "newmtl a\nKd 1 0 0\n";
-    }
-    {
-        boost::nowide::ofstream out(obj.string());
-        out << "mtllib " << mtl.path().filename().string() << "\n"
-            << "v 0 0 0\nv 10 0 0\nv 0 10 0\nv 0 0 10\n"
-            << vts
-            << "usemtl a\n"
-            << first_face << "\n"
-            << "f 1/1 2/1 4/1\nf 1/1 4/1 3/1\nf 2/1 3/1 4/1\n";
-    }
-    LoadedObj   loaded;
-    std::string message;
-    loaded.ok = load_obj(obj.string().c_str(), &loaded.mesh, loaded.info, message);
-    return loaded;
-}
-
-} // namespace
-
-TEST_CASE("An out-of-range texture index falls back to a zero UV and keeps the geometry", "[OBJ][Regression]")
-{
-    const LoadedObj loaded = load_textured_tetrahedron("f 1/1000000000 3/1 2/1");
-
-    REQUIRE(loaded.ok);
-    CHECK(loaded.mesh.facets_count() == 4);
-    REQUIRE(loaded.info.uvs.size() == 4);
-    const std::array<Vec2f, 3> &uv = loaded.info.uvs.front();
-    CHECK_THAT(uv[0].x(), WithinAbs(0., 1e-6));
-    CHECK_THAT(uv[0].y(), WithinAbs(0., 1e-6));
-    CHECK_THAT(uv[1].x(), WithinAbs(0.25, 1e-6));
-    CHECK_THAT(uv[1].y(), WithinAbs(0.5, 1e-6));
-}
-
-TEST_CASE("A face without texture indices loads among faces that have them", "[OBJ][Regression]")
-{
-    const LoadedObj loaded = load_textured_tetrahedron("f 1 3 2");
-
-    REQUIRE(loaded.ok);
-    CHECK(loaded.mesh.facets_count() == 4);
-    // One UV entry per face, so later faces keep their own coordinates.
-    REQUIRE(loaded.info.uvs.size() == 4);
-    for (const Vec2f &uv : loaded.info.uvs.front()) {
-        CHECK_THAT(uv.x(), WithinAbs(0., 1e-6));
-        CHECK_THAT(uv.y(), WithinAbs(0., 1e-6));
-    }
-    CHECK_THAT(loaded.info.uvs[1][0].x(), WithinAbs(0.25, 1e-6));
-    CHECK_THAT(loaded.info.uvs[1][0].y(), WithinAbs(0.5, 1e-6));
-}
-
-TEST_CASE("A negative texture index counts back from the last texture coordinate", "[OBJ]")
-{
-    // -1 is the most recent vt (0.75, 1), -2 the one before it (0.25, 0.5).
-    const LoadedObj loaded = load_textured_tetrahedron("f 1/-2 3/-1 2/-1");
-
-    REQUIRE(loaded.ok);
-    CHECK(loaded.mesh.facets_count() == 4);
-    REQUIRE(loaded.info.uvs.size() == 4);
-    const std::array<Vec2f, 3> &uv = loaded.info.uvs.front();
-    CHECK_THAT(uv[0].x(), WithinAbs(0.25, 1e-6));
-    CHECK_THAT(uv[0].y(), WithinAbs(0.5, 1e-6));
-    CHECK_THAT(uv[1].x(), WithinAbs(0.75, 1e-6));
-    CHECK_THAT(uv[1].y(), WithinAbs(1., 1e-6));
-}
-
-TEST_CASE("Texture coordinates with a w component are kept", "[OBJ][Regression]")
-{
-    const LoadedObj loaded = load_textured_tetrahedron("f 1/1 3/2 2/2", "vt 0.25 0.5 0\nvt 0.75 1 0\n");
-
-    REQUIRE(loaded.ok);
-    CHECK(loaded.mesh.facets_count() == 4);
-    REQUIRE(loaded.info.uvs.size() == 4);
-    const std::array<Vec2f, 3> &uv = loaded.info.uvs.front();
-    CHECK_THAT(uv[0].x(), WithinAbs(0.25, 1e-6));
-    CHECK_THAT(uv[0].y(), WithinAbs(0.5, 1e-6));
-    CHECK_THAT(uv[1].x(), WithinAbs(0.75, 1e-6));
-    CHECK_THAT(uv[1].y(), WithinAbs(1., 1e-6));
-}
-
-TEST_CASE("A texture coordinate with w does not shift the indices of the ones after it", "[OBJ][Regression]")
-{
-    // The w on the first vt used to drop that line, so vt 2 resolved to the third coordinate.
-    const LoadedObj loaded = load_textured_tetrahedron("f 1/2 3/3 2/-1", "vt 0.1 0.2 0\nvt 0.25 0.5\nvt 0.75 1\n");
-
-    REQUIRE(loaded.ok);
-    REQUIRE(loaded.info.uvs.size() == 4);
-    const std::array<Vec2f, 3> &uv = loaded.info.uvs.front();
-    CHECK_THAT(uv[0].x(), WithinAbs(0.25, 1e-6));
-    CHECK_THAT(uv[0].y(), WithinAbs(0.5, 1e-6));
-    CHECK_THAT(uv[1].x(), WithinAbs(0.75, 1e-6));
-    CHECK_THAT(uv[1].y(), WithinAbs(1., 1e-6));
-    CHECK_THAT(uv[2].x(), WithinAbs(0.75, 1e-6));
-    CHECK_THAT(uv[2].y(), WithinAbs(1., 1e-6));
-}

tests/libslic3r/test_utils.cpp

@@ -152,3 +152,71 @@ TEST_CASE("resolve_cli_input_path leaves inputs that must not be completed uncha
         REQUIRE(resolve_cli_input_path("").empty());
     }
 }
+
+TEST_CASE("is_path_within_root accepts a root given with a trailing separator", "[utils]") {
+    ScopedTemporaryDir tmp;
+    const std::string root = tmp.path().string();
+    const std::string with_separator = GENERATE_COPY(root + "/", root + std::string(1, static_cast<char>(boost::filesystem::path::preferred_separator)));
+
+    CAPTURE(with_separator);
+    CHECK(is_path_within_root("vendor.json", with_separator));
+    CHECK(is_path_within_root("vendor/machine/printer.json", with_separator));
+    CHECK_FALSE(is_path_within_root("../vendor.json", with_separator));
+}
+
+TEST_CASE("is_path_within_root treats Windows-specific name forms the same on every platform", "[utils]") {
+    ScopedTemporaryDir tmp;
+
+    SECTION("names ending in dots or spaces stay inside the root") {
+        const std::string name = GENERATE(std::string("name."), std::string("name "), std::string("dir./file.json"), std::string("dir /file.json"));
+        CAPTURE(name);
+        CHECK(is_path_within_root(name, tmp.path()));
+    }
+    SECTION("drive-relative names are rejected") {
+        const std::string name = GENERATE(std::string("C:x"), std::string("c:x/y.json"), std::string("C:"));
+        CAPTURE(name);
+        CHECK_FALSE(is_path_within_root(name, tmp.path()));
+    }
+}
+
+TEST_CASE("is_symlink_target_within_root accepts relative targets that stay inside the root", "[utils]") {
+    ScopedTemporaryDir tmp;
+    const auto [link, target] = GENERATE(std::make_pair(std::string("Versions/Current"), std::string("A")),
+                                         std::make_pair(std::string("Foo.framework/Foo"), std::string("Versions/Current/Foo")),
+                                         std::make_pair(std::string("libfoo.so"), std::string("libfoo.so.1")),
+                                         std::make_pair(std::string("a/b/link"), std::string("c/d")));
+    CAPTURE(link, target);
+    CHECK(is_symlink_target_within_root(link, target, tmp.path()));
+}
+
+TEST_CASE("is_symlink_target_within_root rejects absolute targets and targets that climb out", "[utils]") {
+    ScopedTemporaryDir tmp;
+    const std::string outside = (tmp.path().parent_path() / "outside").generic_string();
+    const auto [link, target] = GENERATE_COPY(std::make_pair(std::string("sub/link"), outside),
+                                              std::make_pair(std::string("sub/link"), std::string("/etc/passwd")),
+                                              std::make_pair(std::string("sub/link"), std::string("\\outside")),
+                                              std::make_pair(std::string("sub/link"), std::string("C:/outside")),
+                                              std::make_pair(std::string("sub/link"), std::string("C:outside")),
+                                              std::make_pair(std::string("sub/link"), std::string("")),
+                                              std::make_pair(std::string("link"), std::string("..")),
+                                              std::make_pair(std::string("link"), std::string("../outside")),
+                                              std::make_pair(std::string("sub/link"), std::string("../../outside")),
+                                              std::make_pair(std::string("sub/link"), std::string("x/../../../outside")),
+                                              std::make_pair(std::string("sub/link"), std::string("..\\..\\outside")));
+    CAPTURE(link, target);
+    CHECK_FALSE(is_symlink_target_within_root(link, target, tmp.path()));
+}
+
+#ifndef _WIN32
+TEST_CASE("is_symlink_target_within_root rejects a target that passes through a symlink leading out", "[utils]") {
+    ScopedTemporaryDir tmp;
+    const boost::filesystem::path root    = tmp.path() / "root";
+    const boost::filesystem::path outside = tmp.path() / "outside";
+    boost::filesystem::create_directories(root);
+    boost::filesystem::create_directories(outside);
+    boost::filesystem::create_symlink(outside, root / "out");
+
+    CHECK_FALSE(is_symlink_target_within_root("link", "out/lib.so", root));
+    CHECK(is_symlink_target_within_root("link", "in/lib.so", root));
+}
+#endif

tests/slic3rutils/CMakeLists.txt

@@ -18,7 +18,6 @@ add_executable(${_TEST_NAME}_tests
     test_plugin_install.cpp
     test_plugin_lifecycle.cpp
     test_plugin_printer_agent.cpp
-    test_printhost.cpp
     test_slicing_pipeline_bindings.cpp
     test_slicing_pipeline_config.cpp
     test_plugin_sort.cpp

tests/slic3rutils/test_printhost.cpp

@@ -1,213 +0,0 @@
-#include <catch2/catch_all.hpp>
-
-#include <nlohmann/json.hpp>
-
-#include "slic3r/Utils/PrintHost.hpp"
-
-using namespace Slic3r;
-
-namespace {
-
-class TestPrintHost : public PrintHost
-{
-public:
-    using PrintHost::format_error;
-
-    const char* get_name() const override { return "Test"; }
-    bool test(wxString&) const override { return true; }
-    wxString get_test_ok_msg() const override { return {}; }
-    wxString get_test_failed_msg(wxString&) const override { return {}; }
-    bool upload(PrintHostUpload, ProgressFn, ErrorFn, InfoFn) const override { return true; }
-    bool has_auto_discovery() const override { return false; }
-    bool can_test() const override { return false; }
-    PrintHostPostUploadActions get_post_upload_actions() const override { return {}; }
-    std::string get_host() const override { return {}; }
-};
-
-std::string format_error(const std::string& body, const std::string& error, unsigned status)
-{
-    return TestPrintHost().format_error(body, error, status).ToStdString();
-}
-
-std::string envelope(int code, const std::string& message, const std::string& traceback)
-{
-    return nlohmann::json{{"error", {{"code", code}, {"message", message}, {"traceback", traceback}}}}.dump();
-}
-
-std::string moonraker_error(int code, const std::string& message, const std::string& detail = {})
-{
-    std::string line = "tornado.web.HTTPError: HTTP " + std::to_string(code) + ": " + message;
-    if (!detail.empty())
-        line += " (" + detail + ")";
-    return envelope(code, message, "Traceback (most recent call last):\n  ...\n" + line + "\n");
-}
-
-// A real Moonraker body for uploading a file that is being printed.
-constexpr const char* k_busy_file_403 =
-    R"JSON({"error": {"code": 403, "message": "Forbidden", "traceback": "Traceback (most recent call last):\n\n  File \"/home/lava/moonraker/moonraker/components/file_manager/file_manager.py\", line 1017, in _finish_gcode_upload\n    can_start = self._handle_operation_check(check_path)\n                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n\nmoonraker.utils.exceptions.ServerError: File currently in use\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n\n  File \"/home/lava/moonraker/moonraker/components/application.py\", line 1069, in post\n    raise tornado.web.HTTPError(\ntornado.web.HTTPError: HTTP 403: Forbidden (File is loaded, upload not permitted)\n"}})JSON";
-
-} // namespace
-
-TEST_CASE("A Klipper upload error shows its reason instead of a Python traceback", "[PrintHost][Regression]")
-{
-    const std::string msg = format_error(k_busy_file_403, "", 403);
-    INFO("actual: " << msg);
-
-    CHECK(msg == "HTTP 403: Forbidden (File is loaded, upload not permitted)");
-    CHECK_THAT(msg, !Catch::Matchers::ContainsSubstring("Traceback"));
-    CHECK_THAT(msg, !Catch::Matchers::ContainsSubstring("file_manager.py"));
-}
-
-TEST_CASE("The specific cause is recovered from a file endpoint's traceback", "[PrintHost]")
-{
-    SECTION("a plain detail")
-    {
-        const std::string body = moonraker_error(403, "Forbidden", "File is loaded, upload not permitted");
-        CHECK(format_error(body, "", 403) == "HTTP 403: Forbidden (File is loaded, upload not permitted)");
-    }
-
-    SECTION("a detail whose own parentheses nest (a filename)")
-    {
-        const std::string detail = "Directory does not exist (/home/pi/gcodes/plate (1).gcode)";
-        const std::string body   = moonraker_error(400, "Bad Request", detail);
-        CHECK(format_error(body, "", 400) == "HTTP 400: Bad Request (" + detail + ")");
-    }
-
-    SECTION("a detail that contains the reason phrase")
-    {
-        const std::string body = moonraker_error(403, "Forbidden", "Forbidden zone: access denied");
-        CHECK(format_error(body, "", 403) == "HTTP 403: Forbidden (Forbidden zone: access denied)");
-    }
-
-    SECTION("a detail that spans lines")
-    {
-        const std::string detail = "Move out of range\nX=250.000 Y=10.000";
-        const std::string body   = moonraker_error(400, "Bad Request", detail);
-        CHECK(format_error(body, "", 400) == "HTTP 400: Bad Request (" + detail + ")");
-    }
-
-    SECTION("a detail that only repeats the reason phrase is dropped")
-    {
-        const std::string body = moonraker_error(401, "Unauthorized", "Unauthorized");
-        CHECK(format_error(body, "", 401) == "HTTP 401: Unauthorized");
-    }
-}
-
-TEST_CASE("An unhandled exception shows its type and message", "[PrintHost]")
-{
-    const std::string frame = "Traceback (most recent call last):\n"
-                              "  File \"/home/pi/moonraker/moonraker/components/file_manager/file_manager.py\", line 1, in write\n"
-                              "    self._write(data)\n";
-
-    SECTION("a one-line message")
-    {
-        const std::string body = envelope(500, "Internal Server Error", frame + "OSError: [Errno 28] No space left on device\n");
-        CHECK(format_error(body, "", 500) == "HTTP 500: Internal Server Error (OSError: [Errno 28] No space left on device)");
-    }
-
-    SECTION("a message that spans lines")
-    {
-        const std::string body = envelope(500, "Internal Server Error", frame + "ServerError: Klippy request failed\n  see klippy.log\n");
-        CHECK(format_error(body, "", 500) == "HTTP 500: Internal Server Error (ServerError: Klippy request failed\n  see klippy.log)");
-    }
-
-    SECTION("raised while handling an HTTPError with the same code")
-    {
-        const std::string traceback = frame + "tornado.web.HTTPError: HTTP 500: Internal Server Error (Database locked)\n\n"
-                                              "During handling of the above exception, another exception occurred:\n\n" +
-                                      frame + "OSError: [Errno 5] Input/output error\n";
-        const std::string body      = envelope(500, "Internal Server Error", traceback);
-        CHECK(format_error(body, "", 500) == "HTTP 500: Internal Server Error (OSError: [Errno 5] Input/output error)");
-    }
-
-    SECTION("a traceback with no header")
-    {
-        const std::string body = envelope(500, "Internal Server Error", "OSError: [Errno 5] Input/output error");
-        CHECK(format_error(body, "", 500) == "HTTP 500: Internal Server Error (OSError: [Errno 5] Input/output error)");
-    }
-}
-
-TEST_CASE("A reason already complete in message is shown unchanged", "[PrintHost]")
-{
-    SECTION("message is the whole reason, no trailing detail")
-    {
-        const std::string body = moonraker_error(503, "Klippy is not ready");
-        CHECK(format_error(body, "", 503) == "HTTP 503: Klippy is not ready");
-    }
-
-    SECTION("a message that itself contains parentheses is not duplicated")
-    {
-        const std::string reason = "Requested blocks (0-5) are unavailable";
-        const std::string body   = moonraker_error(400, reason);
-        CHECK(format_error(body, "", 400) == "HTTP 400: " + reason);
-    }
-}
-
-TEST_CASE("A Moonraker error with no usable detail shows just the reason phrase", "[PrintHost]")
-{
-    struct Case
-    {
-        const char* name;
-        const char* body;
-        unsigned status;
-        const char* expected;
-    };
-
-    const auto c = GENERATE(
-        Case{"an empty traceback", R"JSON({"error": {"code": 500, "message": "Internal Server Error", "traceback": ""}})JSON", 500,
-             "HTTP 500: Internal Server Error"},
-        Case{"a traceback of only whitespace", R"JSON({"error": {"code": 500, "message": "Internal Server Error", "traceback": "\n \n"}})JSON",
-             500, "HTTP 500: Internal Server Error"});
-
-    DYNAMIC_SECTION(c.name) { CHECK(format_error(c.body, "", c.status) == c.expected); }
-}
-
-TEST_CASE("A percent sign in the reason is not a format specifier", "[PrintHost]")
-{
-    const std::string body = moonraker_error(507, "Insufficient Storage", "disk 100% full");
-    CHECK(format_error(body, "", 507) == "HTTP 507: Insufficient Storage (disk 100% full)");
-}
-
-TEST_CASE("Error bodies that are not a Moonraker envelope are left unchanged", "[PrintHost]")
-{
-    SECTION("OctoPrint's string-valued error member")
-    {
-        const std::string body = R"JSON({"error": "File not found"})JSON";
-        CHECK(format_error(body, "", 404) == "HTTP 404: " + body);
-    }
-
-    SECTION("PrusaLink's top-level message, not under error")
-    {
-        const std::string body = R"JSON({"title": "Conflict", "message": "Printer is printing"})JSON";
-        CHECK(format_error(body, "", 409) == "HTTP 409: " + body);
-    }
-
-    SECTION("a body that is not JSON")
-    {
-        const std::string html = "<html><head><title>502 Bad Gateway</title></head></html>";
-        CHECK(format_error(html, "", 502) == "HTTP 502: " + html);
-    }
-
-    SECTION("an error object with no traceback")
-    {
-        const std::string body = R"JSON({"error": {"code": 500, "message": "Internal Server Error"}})JSON";
-        CHECK(format_error(body, "", 500) == "HTTP 500: " + body);
-    }
-
-    SECTION("an error object whose traceback is null")
-    {
-        const std::string body = R"JSON({"error": {"code": 500, "message": "Internal Server Error", "traceback": null}})JSON";
-        CHECK(format_error(body, "", 500) == "HTTP 500: " + body);
-    }
-
-    SECTION("an envelope whose reason phrase is empty")
-    {
-        const std::string body = envelope(403, "", "Traceback (most recent call last):\nOSError: denied\n");
-        CHECK(format_error(body, "", 403) == "HTTP 403: " + body);
-    }
-
-    SECTION("a transport error with no HTTP status")
-    {
-        CHECK(format_error("", "curl:Could not connect", 0) == "curl:Could not connect");
-    }
-}