4335: Escape skin name when downloading (fixes #4333) r=Jupeyy a=def-

<!-- What is the motivation for the changes of this pull request -->

## Checklist

- [x] Tested the change ingame
- [ ] Provided screenshots if it is a visual change
- [ ] Tested in combination with possibly related configuration options
- [ ] Written a unit test if it works standalone, system.c especially
- [ ] Considered possible null pointers and out of bounds array indexing
- [ ] Changed no physics that affect existing maps
- [ ] Tested the change with [ASan+UBSan or valgrind's memcheck](https://github.com/ddnet/ddnet/#using-addresssanitizer--undefinedbehavioursanitizer-or-valgrinds-memcheck) (optional)


Co-authored-by: def <dennis@felsin9.de>
This commit is contained in:
bors[bot] 2021-11-07 18:03:57 +00:00 committed by GitHub
commit ac3d9d0c9a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -422,7 +422,9 @@ int CSkins::FindImpl(const char *pName)
str_copy(Skin.m_aName, pName, sizeof(Skin.m_aName));
char aUrl[256];
str_format(aUrl, sizeof(aUrl), "%s%s.png", g_Config.m_ClSkinDownloadUrl, pName);
char aEscapedName[256];
EscapeUrl(aEscapedName, sizeof(aEscapedName), pName);
str_format(aUrl, sizeof(aUrl), "%s%s.png", g_Config.m_ClSkinDownloadUrl, aEscapedName);
str_format(Skin.m_aPath, sizeof(Skin.m_aPath), "downloadedskins/%s.%d.tmp", pName, pid());
Skin.m_pTask = std::make_shared<CGetPngFile>(this, Storage(), aUrl, Skin.m_aPath, IStorage::TYPE_SAVE, CTimeout{0, 0, 0}, HTTPLOG::NONE);
m_pClient->Engine()->AddJob(Skin.m_pTask);