fix(connection): Implement file content validation for map transfers

Core/GameEngine/Include/Common/FileSystem.h

@@ -161,6 +161,7 @@ class FileSystem : public SubsystemInterface
 
 	static AsciiString normalizePath(const AsciiString& path);	///< normalizes a file path. The path can refer to a directory. File path must be absolute, but does not need to exist. Returns an empty string on failure.
 	static Bool isPathInDirectory(const AsciiString& testPath, const AsciiString& basePath);	///< determines if a file path is within a base path. Both paths must be absolute, but do not need to exist.
+	static Bool hasValidTransferFileContent(const AsciiString& filePath, const UnsignedByte* data, UnsignedInt dataSize);	///< validates transferred file content in memory before writing to disk.
 
 protected:
 #if ENABLE_FILESYSTEM_EXISTENCE_CACHE

Core/GameEngine/Source/Common/System/FileSystem.cpp

@@ -54,6 +54,7 @@
 #include "Common/GameAudio.h"
 #include "Common/LocalFileSystem.h"
 #include "Common/PerfTimer.h"
+#include "TARGA.h"
 
 
 DECLARE_PERF_TIMER(FileSystem)
@@ -457,3 +458,130 @@ Bool FileSystem::isPathInDirectory(const AsciiString& testPath, const AsciiStrin
 
 	return true;
 }
+
+namespace
+{
+
+enum TransferFileType
+{
+	TransferFileType_Map,
+	TransferFileType_Ini,
+	TransferFileType_Str,
+	TransferFileType_Txt,
+	TransferFileType_Tga,
+	TransferFileType_Wak,
+	TransferFileType_Count
+};
+
+struct TransferFileRule
+{
+	const char* ext;
+	UnsignedInt maxSize;
+};
+
+const TransferFileRule transferFileRules[TransferFileType_Count] =
+{
+	{ ".map", 5 * 1024 * 1024 },
+	{ ".ini", 512 * 1024 },
+	{ ".str", 512 * 1024 },
+	{ ".txt", 512 * 1024 },
+	{ ".tga", 2 * 1024 * 1024 },
+	{ ".wak", 512 * 1024 },
+};
+
+TransferFileType getTransferFileType(const char* extension)
+{
+	for (Int i = 0; i < TransferFileType_Count; ++i)
+	{
+		if (stricmp(extension, transferFileRules[i].ext) == 0)
+		{
+			return static_cast<TransferFileType>(i);
+		}
+	}
+	return TransferFileType_Count;
+}
+
+} // namespace
+
+//============================================================================
+// FileSystem::hasValidTransferFileContent
+//============================================================================
+// TheSuperHackers @security bobtista 12/02/2026 Validates transferred file
+// content in memory before writing to disk.
+Bool FileSystem::hasValidTransferFileContent(const AsciiString& filePath, const UnsignedByte* data, UnsignedInt dataSize)
+{
+	const char* lastDot = strrchr(filePath.str(), '.');
+	if (lastDot == nullptr)
+	{
+		DEBUG_LOG(("File '%s' has no extension for content validation.", filePath.str()));
+		return false;
+	}
+
+	const TransferFileType fileType = getTransferFileType(lastDot);
+	if (fileType == TransferFileType_Count)
+	{
+		DEBUG_LOG(("File '%s' has unrecognized extension '%s' for content validation.", filePath.str(), lastDot));
+		return false;
+	}
+
+	// Check size limit
+	const TransferFileRule& rule = transferFileRules[fileType];
+	if (dataSize > rule.maxSize)
+	{
+		DEBUG_LOG(("File '%s' exceeds maximum size (%u bytes, limit %u bytes).", filePath.str(), dataSize, rule.maxSize));
+		return false;
+	}
+
+	// Extension-specific content validation
+	switch (fileType)
+	{
+	case TransferFileType_Map:
+	{
+		if (dataSize < 4 || memcmp(data, "CkMp", 4) != 0)
+		{
+			DEBUG_LOG(("Map file '%s' has invalid magic bytes.", filePath.str()));
+			return false;
+		}
+		break;
+	}
+
+	case TransferFileType_Ini:
+	{
+		for (UnsignedInt i = 0; i < dataSize; ++i)
+		{
+			if (data[i] == 0)
+			{
+				DEBUG_LOG(("INI file '%s' contains null bytes (likely binary).", filePath.str()));
+				return false;
+			}
+		}
+		break;
+	}
+
+	case TransferFileType_Tga:
+	{
+		if (dataSize < sizeof(TGAHeader) + sizeof(TGA2Footer))
+		{
+			DEBUG_LOG(("TGA file '%s' is too small to be valid.", filePath.str()));
+			return false;
+		}
+		TGA2Footer footer;
+		memcpy(&footer, data + dataSize - sizeof(footer), sizeof(footer));
+		if (memcmp(footer.Signature, TGA2_SIGNATURE, sizeof(footer.Signature)) != 0
+			|| footer.RsvdChar != '.'
+			|| footer.BZST != '\0')
+		{
+			DEBUG_LOG(("TGA file '%s' is missing TRUEVISION-XFILE footer signature.", filePath.str()));
+			return false;
+		}
+		break;
+	}
+
+	default:
+	{
+		break;
+	}
+	}
+
+	return true;
+}

Core/GameEngine/Source/GameNetwork/ConnectionManager.cpp

@@ -31,6 +31,7 @@
 #include "Common/CRCDebug.h"
 #include "Common/Debug.h"
 #include "Common/file.h"
+#include "Common/FileSystem.h"
 #include "Common/GameAudio.h"
 #include "Common/LocalFileSystem.h"
 #include "Common/Player.h"
@@ -734,6 +735,20 @@ void ConnectionManager::processFile(NetFileCommandMsg *msg)
 	}
 #endif // COMPRESS_TARGAS
 
+	// TheSuperHackers @security bobtista 12/02/2026 Validate file content in memory before writing to disk
+	if (!FileSystem::hasValidTransferFileContent(realFileName, buf, len))
+	{
+		DEBUG_LOG(("File '%s' failed content validation. Transfer aborted.", realFileName.str()));
+#ifdef COMPRESS_TARGAS
+		if (deleteBuf)
+		{
+			delete[] buf;
+			buf = nullptr;
+		}
+#endif // COMPRESS_TARGAS
+		return;
+	}
+
 	File *fp = TheFileSystem->openFile(realFileName.str(), File::CREATE | File::BINARY | File::WRITE);
 	if (fp)
 	{