Summary

Product: InputLeap v3.0.3
Vendor: input-leap
Vulnerability: Path Traversal
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Description

InputLeap's drag-and-drop handler tries to sanitize filenames by finding the last path separator and keeping only the part after it. When no separator is found, the C++ string search returns a special sentinel value called npos to indicate failure. However, the code never checks for this sentinel before using the result in arithmetic calculations. Because npos is defined as the largest possible unsigned integer, subtracting it wraps around silently and produces a valid-looking answer that's completely wrong: instead of returning just the filename, it returns the entire unsanitized original string. An attacker can exploit this by crafting a message where one entry lacks a separator while another contains a mismatched one — the code's global separator-detection heuristic flips, the search fails silently, and ....\AppData...\Startup\evil.exe passes through untouched. That string then gets concatenated to the drop directory and handed to the OS, which interprets the .. sequences and writes the file outside the intended folder. The vulnerability exists because a defensive check for the "not found" case is missing.

Steps to Reproduce

1. Enable --enable-drag-drop on the target (opt-in, default OFF).
2. As a connected peer, initiate a drag-and-drop file-transfer message whose embedded filename data contains a "/" character somewhere in the buffer (to force slash="/") while the actual filename segment uses "\" separators, e.g. embedding a stray "/" earlier in the data blob and a filename of "..\..\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\evil.exe".
3. DragInformation::parseDragInfo's find_last_of(slash, ...) returns npos for the "\"-separated filename portion, causing unsigned arithmetic wraparound and returning the full untruncated path.