fix: harden MultiMC/authlib/IO trust boundaries (#8–#13) #14

2026-11-09T15:19:28Z

layue13 commented

2026-11-09 15:19:28 +00:00

Summary

Fixes all six open scan issues on TDLM/HMCL in one PR (HMC-16).

Issue	Fix
#8 p0 MultiMC PreLaunch/Wrapper	Do not import `OverrideCommands` / `OverrideJavaArgs` into instance settings
#9 p0 MultiMC `+jvmArgs`	`JvmArgumentFilter` denylist (`-javaagent`, `-agent`, `-Xbootclasspath`, `-XX:OnError`) in patch assemble + lwjgl3ify inject
#10 p2 unbounded HTTP read	Cap `NetworkUtils` / `HttpRequest` body reads at 16 MiB
#11 p2 `copyDirectory` escape	`normalize` + `startsWith(dest)` like `Unzipper`
#12 p3 `openLink` schemes	Allow only `http` / `https` / `mailto` (FXUtils + DesktopUtils)
#13 p3 authlib api-location	Follow redirect only for same-host HTTPS

No UI redesign. Separate from publish/CDN PR #7.

Test

./gradlew :HMCLCore:test --tests JvmArgumentFilterTest --tests IOUtilsReadLimitTest --tests CopyDirectoryTraversalTest + compile HMCL/HMCLBoot.

## Summary Fixes all six open scan issues on `TDLM/HMCL` in one PR (HMC-16). | Issue | Fix | |---|---| | **#8** p0 MultiMC PreLaunch/Wrapper | Do not import `OverrideCommands` / `OverrideJavaArgs` into instance settings | | **#9** p0 MultiMC `+jvmArgs` | `JvmArgumentFilter` denylist (`-javaagent`, `-agent*`, `-Xbootclasspath`, `-XX:On*Error`) in patch assemble + lwjgl3ify inject | | **#10** p2 unbounded HTTP read | Cap `NetworkUtils` / `HttpRequest` body reads at 16 MiB | | **#11** p2 `copyDirectory` escape | `normalize` + `startsWith(dest)` like `Unzipper` | | **#12** p3 `openLink` schemes | Allow only `http` / `https` / `mailto` (FXUtils + DesktopUtils) | | **#13** p3 authlib api-location | Follow redirect only for same-host HTTPS | No UI redesign. Separate from publish/CDN PR #7. ## Test `./gradlew :HMCLCore:test --tests JvmArgumentFilterTest --tests IOUtilsReadLimitTest --tests CopyDirectoryTraversalTest` + compile HMCL/HMCLBoot.

layue13 referenced this issue from a commit

2026-11-09 17:08:47 +00:00

ci: use actions/gradle-actions on security fix branch

layue13 force-pushed cursor/fix-open-security-issues-1729 from 3def8cbf7b to 7f8bfe4f3d

2026-11-09 20:22:52 +00:00

Compare

layue13 added 1 commit 2026-11-09 21:19:45 +00:00

fix: harden MultiMC/authlib/IO trust boundaries (#8–#13)

Mirror Repository / Mirror to CNB (push) Skipped

Details

Mirror Repository / Mirror to Gitee (push) Skipped

Details

Java CI / build (pull_request) Successful in 12m50s

Details

551bd4cef2

- #8: do not import MultiMC PreLaunch/Wrapper/JVM overrides from packs
- #9: filter dangerous +jvmArgs from MultiMC patches / lwjgl3ify
- #10: cap HTTP body reads at 16 MiB
- #11: guard FileUtils.copyDirectory against path escape
- #12: allow only http/https/mailto in openLink
- #13: follow authlib api-location only on same-host HTTPS