From 899013ca5b699ed47a540c0e244cc2829263fc33 Mon Sep 17 00:00:00 2001 From: Michael Vasseur <14887731+vmcj@users.noreply.github.com> Date: Sun, 21 Dec 2025 18:07:19 +0100 Subject: [PATCH] Defence in depth for adding directories to the zip Found while debugging the MathJax issue (https://github.com/DOMjudge/domjudge/pull/3276), MathJax requires the `mathjaxfonts` to be specified in the config. We parse that URL and try to add that directory to the zip which fails. --- webapp/src/Service/DOMJudgeService.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/webapp/src/Service/DOMJudgeService.php b/webapp/src/Service/DOMJudgeService.php index 994a8c407a..fca9cd5eb8 100644 --- a/webapp/src/Service/DOMJudgeService.php +++ b/webapp/src/Service/DOMJudgeService.php @@ -1574,6 +1574,10 @@ public function getScoreboardZip( if ($filepath === false) { throw new Exception("Could not find (possibly symlinked) file: " . $file . ", at: " . $publicPath); } + if (!in_array(filetype($filepath), ['file', 'link'])) { + // Ignore special filetypes + continue; + } if (!(str_starts_with($filepath, $publicPath) || str_starts_with($filepath, $this->vendorDir) || str_starts_with($filepath, $this->nodeModulesDir))