From 468f90ad4837f749ca09aa118e0f7b8c5f2dae82 Mon Sep 17 00:00:00 2001
From: Yamagi <yamagi@yamagi.org>
Date: Sat, 22 Jun 2024 16:52:42 +0200
Subject: [PATCH] Implement a simple download filter.

`cl_nodownload_list` is a whitespace seperated list of strings, files
containing one of these strings in their name are never downloaded. Set
to `.dll .dylib .so` by default to prevent downloading libraries which
can be injected into client.

Closes #1114.
---
 doc/040_cvarlist.md        |  8 ++++++--
 src/client/cl_download.c   | 11 +++++++++++
 src/client/cl_main.c       |  2 ++
 src/client/header/client.h |  1 +
 4 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/doc/040_cvarlist.md b/doc/040_cvarlist.md
index 045d2cbb..a4da8fe1 100644
--- a/doc/040_cvarlist.md
+++ b/doc/040_cvarlist.md
@@ -138,14 +138,18 @@ it's `+set busywait 0` (setting the `busywait` cvar) and `-portable`
   loading. If set to `0` pause mode is never entered, this is the
   Vanilla Quake II behaviour.
 
-* **cl_model_preview_start**: start frame value in multiplayer model
+* **cl_model_preview_start**: Start frame value in multiplayer model
   preview.  `-1` - don't show animation. Defaults to `84` for show
   salute animation.
 
-* **cl_model_preview_end**: end frame value in multiplayer model
+* **cl_model_preview_end**: End frame value in multiplayer model
   preview.  `-1` - don't show animation. Defaults to `94` for show
   salute animation.
 
+* **cl_nodownload_list**: Whitespace seperated list of strings, files
+  having one these strings in their name are never downloaded. Set to
+  `.dll .dylib .so` by default.
+
 * **cl_r1q2_lightstyle**: Since the first release Yamagi Quake II used
   the R1Q2 colors for the dynamic lights of rockets. Set to `0` to get
   the Vanilla Quake II colors. Defaults to `1`.
diff --git a/src/client/cl_download.c b/src/client/cl_download.c
index a95fbdb3..2ca2bde4 100644
--- a/src/client/cl_download.c
+++ b/src/client/cl_download.c
@@ -571,6 +571,17 @@ CL_CheckOrDownloadFile(char *filename)
 		return true;
 	}
 
+	char *nodownload = strtok(cl_nodownload_list->string, " ");
+	while (nodownload != NULL)
+	{
+		if (Q_strcasestr(filename, nodownload))
+		{
+			Com_Printf("Filename is filtered by cl_nodownload_list: %s\n", filename);
+			return true;
+		}
+		nodownload = strtok(NULL, " ");
+	}
+
 #ifdef USE_CURL
 	if (!forceudp)
 	{
diff --git a/src/client/cl_main.c b/src/client/cl_main.c
index 1d5b1132..3a94fc07 100644
--- a/src/client/cl_main.c
+++ b/src/client/cl_main.c
@@ -51,6 +51,7 @@ cvar_t *cl_add_entities;
 cvar_t *cl_add_blend;
 cvar_t *cl_kickangles;
 cvar_t *cl_laseralpha;
+cvar_t *cl_nodownload_list;
 
 cvar_t *cl_shownet;
 cvar_t *cl_showmiss;
@@ -517,6 +518,7 @@ CL_InitLocal(void)
 	cl_showfps = Cvar_Get("cl_showfps", "0", CVAR_ARCHIVE);
 	cl_showspeed = Cvar_Get("cl_showspeed", "0", CVAR_ARCHIVE);	
 	cl_laseralpha = Cvar_Get("cl_laseralpha", "0.3", 0);
+	cl_nodownload_list = Cvar_Get("cl_nodownload_list", ".dll .dylib .so", 0);
 
 	cl_upspeed = Cvar_Get("cl_upspeed", "200", 0);
 	cl_forwardspeed = Cvar_Get("cl_forwardspeed", "200", 0);
diff --git a/src/client/header/client.h b/src/client/header/client.h
index 0cdef885..4e7def1e 100644
--- a/src/client/header/client.h
+++ b/src/client/header/client.h
@@ -317,6 +317,7 @@ extern	cvar_t	*cl_kickangles;
 extern  cvar_t  *cl_r1q2_lightstyle;
 extern  cvar_t  *cl_limitsparksounds;
 extern	cvar_t	*cl_laseralpha;
+extern	cvar_t	*cl_nodownload_list;
 
 typedef struct
 {