Merge remote-tracking branch 'origin/main' into saves/zip-aware-hashing

Author: LxKnsy

Downloads/DownloadQueueController.cs

@@ -1,5 +1,6 @@
 using Playnite.SDK;
 using Playnite.SDK.Plugins;
+using RomM.Games;
 using SharpCompress.Archives;
 using SharpCompress.Common;
 using System;
@@ -176,7 +177,8 @@ private async Task DownloadAndInstall(DownloadQueueItem item, DownloadRequest re
             }
 
             // Extract if needed (we treat extract as 0..100 in its own bar)
-            if (req.HasMultipleFiles || (req.AutoExtract && IsFileCompressed(req.GamePath)))
+            // Don't extract archives when install flat is enabled
+            if (req.HasMultipleFiles || (req.AutoExtract && IsFileCompressed(req.GamePath) && !req.InstallFlat))
             {
                 item.SetStatus(DownloadStatus.Extracting, "Extracting...");
                 Logger.Info($"Extracting {req.GamePath}...");
@@ -213,6 +215,32 @@ private static bool IsFileCompressed(string filePath)
         }
 
 
+        // 7-Zip extracts into the output dir and drops absolute paths and ".." components unless -spf
+        // is passed (we never pass it), but the entry names are checked up front anyway so both
+        // extraction paths refuse traversal the same way. Formats SharpCompress cannot open fall back
+        // to 7-Zip's own handling rather than failing a download that used to work.
+        private void EnsureEntriesContained(string archivePath, string installDir)
+        {
+            try
+            {
+                using (var archive = ArchiveFactory.Open(archivePath))
+                {
+                    foreach (var entry in archive.Entries.Where(e => !e.IsDirectory))
+                    {
+                        RomMInstallPaths.ResolveWithin(installDir, entry.Key);
+                    }
+                }
+            }
+            catch (ArgumentException)
+            {
+                throw;
+            }
+            catch (Exception ex)
+            {
+                Logger.Warn($"Could not inspect {archivePath} before extraction: {ex.Message}");
+            }
+        }
+
         private void ExtractArchiveWith7z(string pathTo7z, string archivePath, string installDir, DownloadQueueItem item, CancellationToken ct)
         {
             if (archivePath == null || archivePath.Contains("../") || archivePath.Contains(@"..\"))
@@ -224,6 +252,8 @@ private void ExtractArchiveWith7z(string pathTo7z, string archivePath, string in
                 throw new ArgumentException("Invalid install directory path");
             }
 
+            EnsureEntriesContained(archivePath, installDir);
+
             ProcessStartInfo startInfo = new ProcessStartInfo
             {
                 FileName = pathTo7z,
@@ -256,11 +286,17 @@ private void ExtractArchiveWithEntryProgress(string archivePath, string installD
                 {
                     ct.ThrowIfCancellationRequested();
 
-                    entry.WriteToDirectory(installDir, new ExtractionOptions
+                    // Entry names come from the downloaded archive, so they are untrusted: handing a
+                    // "../" or rooted key to ExtractFullPath would write outside installDir. Resolve
+                    // and verify each destination, then copy the entry there ourselves.
+                    var destination = RomMInstallPaths.ResolveWithin(installDir, entry.Key);
+                    Directory.CreateDirectory(Path.GetDirectoryName(destination));
+
+                    using (var entryStream = entry.OpenEntryStream())
+                    using (var file = File.Create(destination))
                     {
-                        ExtractFullPath = true,
-                        Overwrite = true
-                    });
+                        entryStream.CopyTo(file);
+                    }
 
                     done++;
                     item.SetProgress(done, total, false);
@@ -288,7 +324,8 @@ private void TryCleanupPartialInstall(DownloadRequest req)
                 SafeDeleteFileWithRetry(req.GamePath);
 
                 // delete folder (recursively) if it exists
-                SafeDeleteDirectoryWithRetry(req.InstallDir);
+                if(!req.InstallFlat)
+                    SafeDeleteDirectoryWithRetry(req.InstallDir);
             }
             catch (Exception ex)
             {

Downloads/DownloadRequest.cs

@@ -16,7 +16,7 @@ public class DownloadRequest
         public bool AutoExtract { get; set; } = true;
         public bool Use7z { get; set; } = false;
         public string PathTo7Z { get; set; } = "";
-
+        public bool InstallFlat { get; set; } = false;
 
         /// Optional function used after extraction to build rom list for Playnite
         public Func<List<GameRom>> BuildRoms { get; set; }

Games/RomMGameInfo.Plugin.cs

@@ -26,7 +26,7 @@ public EmulatorMapping Mapping
 
         public InstallController GetInstallController(Game game, RomM romm, GameInstallInfo GameData) => new RomMInstallController(game, romm, GameData);
 
-        public UninstallController GetUninstallController(Game game, RomM romm) => new RomMUninstallController(game, romm);
+        public UninstallController GetUninstallController(Game game, RomM romm, EmulatorMapping mapping) => new RomMUninstallController(game, romm, mapping);
 
         protected IEnumerable<string> GetDescriptionLines()
         {

Games/RomMImport.cs

@@ -189,10 +189,29 @@ private Game ImportGame(RomMRom ROM, Guid StatusID)
             // Paths must be derived from the actual ROM file (what RomMInstallController downloads),
             // not the display Name. Using Name drops the extension and can include characters that
             // don't match the installed file, breaking IsInstalled detection and the play path.
+            //
+            // For folder-based ROMs we point at a real file inside the ROM's folder (fs_name):
+            //   - nested single file: the one file in the folder,
+            //   - multiple files: the primary file (the download descriptor's FileName is the folder
+            //     name / archive base, which is not itself a real file, so use the primary file here).
             var baseRevision = BuildRevision(ROM);
-            var fileName = !string.IsNullOrEmpty(baseRevision?.FileName) ? baseRevision.FileName : ROM.Name;
-            var gameInstallDir = RomMInstallPaths.InstallDir(rootInstallDir, fileName);
-            var pathToGame = RomMInstallPaths.GamePath(rootInstallDir, fileName);
+            var folderName = baseRevision?.FolderName;
+            var playableFile = ROM.HasMultipleFiles
+                ? RomMRevisionFactory.RelativeFilePath(RomMRevisionFactory.SelectPrimaryFile(ROM.Files), folderName)
+                : baseRevision?.FileName;
+            // With no file list, fs_name still beats the extensionless display Name.
+            var fileName = !string.IsNullOrEmpty(playableFile) ? playableFile
+                : !string.IsNullOrEmpty(ROM.FileName) ? ROM.FileName
+                : ROM.Name;
+            // Skip the ROM rather than letting the throw from RomMInstallPaths abort the whole platform.
+            if (!RomMInstallPaths.IsContained(folderName) || !RomMInstallPaths.IsContained(fileName))
+            {
+                _plugin.Logger.Error($"[Importer] RomM ID {ROM.Id} has a path outside the install root: {folderName} / {fileName}");
+                return null;
+            }
+
+            var gameInstallDir = _mapping.InstallFlat ? rootInstallDir : RomMInstallPaths.InstallDir(rootInstallDir, folderName, fileName);
+            var pathToGame = _mapping.InstallFlat ? $"{rootInstallDir}\\{fileName}" : RomMInstallPaths.GamePath(rootInstallDir, folderName, fileName);
 
             var status = _plugin.Playnite.Database.CompletionStatuses.Get(StatusID);
             var completionStatusProperty = status != null ? new MetadataNameProperty(status.Name) : null;
@@ -227,6 +246,7 @@ private Game ImportGame(RomMRom ROM, Guid StatusID)
                 }
             };
 
+
             // Import new game
             Game game = _plugin.Playnite.Database.ImportGame(metadata, _plugin);
 

Games/RomMInstallController.cs

@@ -1,14 +1,15 @@
-using Playnite.SDK;
+using Newtonsoft.Json;
+using Playnite.SDK;
 using Playnite.SDK.Models;
 using Playnite.SDK.Plugins;
 using RomM.Downloads;
 using RomM.Models.RomM.Rom;
+using RomM.Settings;
 using SharpCompress.Archives;
 using System;
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
-using Newtonsoft.Json;
 
 namespace RomM.Games
 {
@@ -41,8 +42,14 @@ public override void Install(InstallActionArgs args)
             var dstPath = _gameData.Mapping?.DestinationPathResolved
                 ?? throw new Exception("Mapped emulator data cannot be found, try removing and re-adding.");
 
-            // Paths (same as before)
-            var installDir = Path.Combine(dstPath, Path.GetFileNameWithoutExtension(_gameData.FileName));
+            // Install dir mirrors RomM's on-disk layout: folder-based ROMs (nested single / multiple
+            // files) install into the ROM's folder (fs_name); simple single files fall back to a
+            // folder derived from the file name. Must match the path computed at import time so
+            // IsInstalled detection lines up.
+            var installDir = RomMInstallPaths.InstallDir(dstPath, _gameData.FolderName, _gameData.FileName);
+
+            if (_gameData.Mapping.InstallFlat)
+                installDir = dstPath;
 
             // If RomM indicates multiple files, we download as an archive name (zip) into the install folder.
             // Otherwise we download the single ROM file.
@@ -63,6 +70,7 @@ public override void Install(InstallActionArgs args)
 
                 HasMultipleFiles = _gameData.HasMultipleFiles,
                 AutoExtract = _gameData.Mapping != null && _gameData.Mapping.AutoExtract,
+                InstallFlat = _gameData.Mapping.InstallFlat,
 
                 // Called by queue AFTER download/extract is done
                 BuildRoms = () =>

Games/RomMInstallPaths.cs

@@ -1,19 +1,69 @@
+using System;
 using System.IO;
+using System.Linq;
 
 namespace RomM.Games
 {
     // Derives a ROM's install directory and playable path. These MUST come from the actual ROM file
     // name (what gets downloaded), not the display name: using the display name drops the extension
     // and can include characters that don't match the installed file, breaking IsInstalled detection
     // and the play path.
+    //
+    // For folder-based ROMs (nested single file / multiple files) a non-null folderName (fs_name)
+    // pins the directory to the ROM's actual folder on the RomM filesystem, instead of deriving it
+    // from the download file name — the file name can carry region tags and an extension that the
+    // containing folder does not (e.g. file "Game (Europe).zip" inside folder "Game").
     internal static class RomMInstallPaths
     {
+        // fs_name and file names come straight from the server, so they are untrusted. A rooted value
+        // ("/tmp", @"C:\x", @"\x") makes Path.Combine discard rootInstallDir and ".." walks back out
+        // of it — either would let the download and archive extraction write outside the configured
+        // mapping. Nested relative paths (a primary file inside a subfolder) stay allowed.
+        // Rooting is checked by hand rather than via Path.IsPathRooted so a Windows-rooted value is
+        // still rejected when this runs on another platform (e.g. the test host).
+        public static bool IsContained(string path)
+            => string.IsNullOrEmpty(path)
+               || (path[0] != '/'
+                   && path[0] != '\\'
+                   && path.IndexOf(':') < 0
+                   && !path.Split('/', '\\').Any(segment => segment == ".."));
+
+        private static string Contained(string path)
+            => IsContained(path) ? path : throw new ArgumentException($"Path from RomM escapes the install root: {path}");
+
+        // Resolves an untrusted relative path against a trusted root, throwing unless the result stays
+        // inside it. Archive entry names are attacker-controlled too, so extraction resolves every
+        // destination through here instead of handing raw keys to SharpCompress' ExtractFullPath.
+        public static string ResolveWithin(string root, string relativePath)
+        {
+            if (string.IsNullOrEmpty(relativePath))
+                throw new ArgumentException("Archive entry has no name, refusing to extract it.");
+
+            var fullRoot = Path.GetFullPath(root).TrimEnd(Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar);
+            var destination = Path.GetFullPath(Path.Combine(fullRoot, Contained(relativePath)));
+
+            if (!destination.StartsWith(fullRoot + Path.DirectorySeparatorChar, StringComparison.OrdinalIgnoreCase))
+                throw new ArgumentException($"Path escapes the install directory: {relativePath}");
+
+            return destination;
+        }
+
         // <root>/<file name without extension>
         public static string InstallDir(string rootInstallDir, string fileName)
-            => Path.Combine(rootInstallDir, Path.GetFileNameWithoutExtension(fileName));
+            => Path.Combine(rootInstallDir, Path.GetFileNameWithoutExtension(Contained(fileName)));
+
+        // <root>/<folder name> when folderName is set, otherwise <root>/<file name without extension>.
+        public static string InstallDir(string rootInstallDir, string folderName, string fileName)
+            => string.IsNullOrEmpty(folderName)
+                ? InstallDir(rootInstallDir, fileName)
+                : Path.Combine(rootInstallDir, Contained(folderName));
 
         // <root>/<file name without extension>/<file name>
         public static string GamePath(string rootInstallDir, string fileName)
-            => Path.Combine(InstallDir(rootInstallDir, fileName), fileName);
+            => Path.Combine(InstallDir(rootInstallDir, fileName), Contained(fileName));
+
+        // <install dir>/<file name>, using the folder-aware install dir.
+        public static string GamePath(string rootInstallDir, string folderName, string fileName)
+            => Path.Combine(InstallDir(rootInstallDir, folderName, fileName), Contained(fileName));
     }
 }

Games/RomMRevisionFactory.cs

@@ -1,4 +1,6 @@
+using System;
 using System.Collections.Generic;
+using System.IO;
 using System.Linq;
 using RomM.Models.RomM.Rom;
 
@@ -20,6 +22,24 @@ public static RomMFile SelectPrimaryFile(IList<RomMFile> files)
             return files.FirstOrDefault();
         }
 
+        // A file's path relative to the ROM folder (fs_name). Extraction preserves subdirectories, so
+        // a file below another directory needs "sub/file.bin", not just "file.bin". Falls back to the
+        // leaf name when the folder is not part of the full path.
+        public static string RelativeFilePath(RomMFile file, string folderName)
+        {
+            if (file == null)
+                return null;
+
+            var segments = (file.FullPath ?? string.Empty).Split('/');
+            var folderIndex = string.IsNullOrEmpty(folderName)
+                ? -1
+                : Array.FindLastIndex(segments, s => s.Equals(folderName, StringComparison.OrdinalIgnoreCase));
+
+            return folderIndex >= 0 && folderIndex < segments.Length - 1
+                ? string.Join(Path.DirectorySeparatorChar.ToString(), segments.Skip(folderIndex + 1))
+                : file.FileName;
+        }
+
         // Returns null when a single-file ROM has no resolvable file. Single files use the 4.9
         // /files/content endpoint when a file id is present, falling back to the rom-level endpoint
         // (so we never emit "api/roms//files/content/..."); multi-file ROMs download the whole archive.
@@ -39,13 +59,18 @@ public static RomMRevision Build(RomMRom rom, string romMHost)
                     return null;
 
                 revision.FileName = romfile.FileName;
+                // A nested single file lives inside a folder named after the ROM (fs_name); a simple
+                // single file sits directly in the platform folder and has no wrapping folder.
+                revision.FolderName = rom.HasNestedSingleFile ? rom.FileName : null;
                 revision.DownloadURL = romfile.Id.HasValue
                     ? RomMUrl.Combine(romMHost, $"api/roms/{romfile.Id}/files/content/{romfile.FileName}")
                     : RomMUrl.Combine(romMHost, $"api/roms/{rom.Id}/content/{romfile.FileName}");
             }
             else
             {
                 revision.FileName = rom.FileName;
+                // Multi-file ROMs are always stored in a folder named after the ROM (fs_name).
+                revision.FolderName = rom.FileName;
                 revision.DownloadURL = RomMUrl.Combine(romMHost, $"api/roms/{rom.Id}/content/{rom.FileName}");
             }
 

Games/RomMUninstallController.cs

@@ -1,5 +1,6 @@
 using Playnite.SDK.Models;
 using Playnite.SDK.Plugins;
+using RomM.Settings;
 using System.IO;
 using System.Windows;
 
@@ -8,24 +9,38 @@ namespace RomM.Games
     internal class RomMUninstallController : UninstallController
     {
         private readonly IRomM _romM;
+        private EmulatorMapping _mapping;
 
-        internal RomMUninstallController(Game game, IRomM romM) : base(game)
+        internal RomMUninstallController(Game game, IRomM romM, EmulatorMapping mapping) : base(game)
         {
             Name = "Uninstall";
             _romM = romM;
+            _mapping = mapping;
         }
 
         public override void Uninstall(UninstallActionArgs args)
         {
-            if (new DirectoryInfo(Game.InstallDirectory).Exists)
+            if(_mapping.InstallFlat)
             {
-                Directory.Delete(Game.InstallDirectory, true);
+                foreach (var RomFile in Game.Roms)
+                {
+                    if(File.Exists(RomFile.Path))
+                        File.Delete(RomFile.Path);
+                }
             }
             else
             {
-                _romM.Playnite.Dialogs.ShowMessage($"\"{Game.Name}\" folder could not be found. Marking as uninstalled.", "Game not found", MessageBoxButton.OK);
+                if (new DirectoryInfo(Game.InstallDirectory).Exists)
+                {
+                    Directory.Delete(Game.InstallDirectory, true);
+                }
+                else
+                {
+                    _romM.Playnite.Dialogs.ShowMessage($"\"{Game.Name}\" folder could not be found. Marking as uninstalled.", "Game not found", MessageBoxButton.OK);
+                }
             }
-            Game.Roms.Clear();
+
+                Game.Roms.Clear();
             InvokeOnUninstalled(new GameUninstalledEventArgs());
         }
     }

Models/RomM/Rom/GameInstallInfo.cs

@@ -8,6 +8,7 @@ public struct GameInstallInfo
     {
         public int Id { get; set; }
         public string FileName { get; set; }
+        public string FolderName { get; set; }
         public bool HasMultipleFiles { get; set; }
         public string DownloadURL { get; set; }
         public EmulatorMapping Mapping { get; set; }

Models/RomM/Rom/RomMRomLocal.cs

@@ -14,6 +14,13 @@ public class RomMRevision
     {
         public int Id { get; set; }
         public string FileName { get; set; }
+
+        // The ROM's folder on the RomM filesystem (fs_name) for folder-based ROMs (nested single file
+        // or multiple files). Null/empty for a "simple" single file that lives directly in the platform
+        // folder. Install paths use this so they mirror RomM's on-disk layout instead of being derived
+        // from the download file name (which can carry region tags / an extension the folder doesn't).
+        public string FolderName { get; set; }
+
         public bool HasMultipleFiles { get; set; }
         public string DownloadURL { get; set; }
         public bool IsSelected { get; set; }