408 - Create world #423

Volte6 · 2025-07-27T23:09:28Z

Description

Adds command line arguments to create a new world.
This just copies the "empty" world currently and updates the config accordingly.
Still some work to be done here.

Changes

--create-world and --list-worlds flags
Removed template files from empty world
If templates aren't found, always failsover to default world's templates.

Links

Create an easier way to start a new world #408

…efault.

internal/templates/templates.go


 		// Get the file contents
-		fileContents, err := os.ReadFile(fullPath)
+		fileContents, err = os.ReadFile(fullPath)


internal/templates/templates.go

+			if !strings.HasSuffix(datafilesPath, `default`) {
+				// try with the last folder name replaced with "default":
+				fullPath = util.FilePath(filepath.Dir(datafilesPath), `/`, `default`, `/`, tplInfo.path)
+				fileContents, err = os.ReadFile(fullPath)


To fix the issue, we need to validate and sanitize the user input (tplInfo.path) before using it to construct the file path. Specifically:

Ensure that the input does not contain any path traversal sequences (..) or path separators (/ or \).

Use filepath.Clean to normalize the path and ensure it remains within a designated safe directory.

Reject any input that does not meet the validation criteria.

The changes will be made in internal/templates/templates.go where tplInfo.path is used to construct fullPath.

Copilot

Pull Request Overview

This PR adds command line arguments to create a new world, implementing functionality to copy the "empty" world template and update configuration accordingly. The changes support creating custom worlds while providing a fallback template system for missing files.

Adds --create-world and --list-worlds command line flags for world management
Removes template files from the empty world to establish it as a clean template
Implements template fallback to default world when templates are missing

Reviewed Changes

Copilot reviewed 208 out of 208 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`internal/worldcli/worldcli.go`	New module containing world creation and listing functionality
`internal/templates/templates.go`	Enhanced template resolution with fallback to default world
`internal/flags/flags.go`	Added command line flag handling for world operations
`_datafiles/world/empty/users/1.yaml`	Updated admin user configuration for empty world
`_datafiles/world/empty/templates/*`	Removed all template files to establish empty as clean template

Copilot · 2025-08-01T18:51:41Z

internal/worldcli/worldcli.go

+	folderName := sanitizeWorldName(worldName)
+	if folderName == "" {
+		mudlog.Error("World Creation", "error", "Invalid world name (reserved names: 'default', 'empty')")


The sanitizeWorldName function returns an empty string for reserved names ('default', 'empty'), but the error message on line 39 suggests these are invalid. This could be confusing - consider making the error message more specific about reserved names versus truly invalid names.

Suggested change

folderName := sanitizeWorldName(worldName)

if folderName == "" {

mudlog.Error("World Creation", "error", "Invalid world name (reserved names: 'default', 'empty')")

// Check for reserved names before sanitizing

lowerName := strings.ToLower(worldName)

if lowerName == "default" || lowerName == "empty" {

mudlog.Error("World Creation", "error", fmt.Sprintf("'%s' is a reserved world name. Please choose a different name.", worldName))

return

}

folderName := sanitizeWorldName(worldName)

if folderName == "" {

mudlog.Error("World Creation", "error", "Invalid world name. Please use only letters, numbers, underscores, and hyphens.")

Copilot · 2025-08-01T18:51:41Z

internal/worldcli/worldcli.go

+
+	if err := updateConfigForNewWorld(folderName); err != nil {
+		mudlog.Error("World Creation", "error", "Failed to update config: "+err.Error())
+		os.RemoveAll(worldPath)


Using os.RemoveAll without proper validation could be dangerous if worldPath is manipulated. Consider adding additional validation to ensure worldPath is within the expected directory structure before removal.

Suggested change

os.RemoveAll(worldPath)

baseWorldDir := filepath.Join("_datafiles", "world")

isSafe, err := isSubdirectory(baseWorldDir, worldPath)

if err != nil {

mudlog.Error("World Creation", "error", "Failed to validate world path for removal: "+err.Error())

} else if isSafe {

os.RemoveAll(worldPath)

} else {

mudlog.Error("World Creation", "error", "Unsafe world path detected, not removing: "+worldPath)

}

Copilot · 2025-08-01T18:51:41Z

internal/worldcli/worldcli.go

+	dataFilesRegex := regexp.MustCompile(`(\s*DataFiles:\s*)_datafiles/world/[^\s]+`)
+	configText = dataFilesRegex.ReplaceAllString(configText, "${1}"+newWorldPath)
+
+	langPathRegex := regexp.MustCompile(`(\s*LanguagePaths:\s*\n\s*-\s*'_datafiles/localize'\s*\n\s*-\s*)'_datafiles/world/[^/]+/localize'`)


The regex pattern is complex and brittle. Consider using a YAML parser library instead of regex for modifying configuration files, which would be more robust and maintainable.

Copilot · 2025-08-01T18:51:42Z

internal/worldcli/worldcli.go

+	langPathRegex := regexp.MustCompile(`(\s*LanguagePaths:\s*\n\s*-\s*'_datafiles/localize'\s*\n\s*-\s*)'_datafiles/world/[^/]+/localize'`)
+	configText = langPathRegex.ReplaceAllString(configText, "${1}'"+newWorldPath+"/localize'")
+
+	if err := os.WriteFile(configPath, []byte(configText), 0644); err != nil {


The file permissions 0644 allow world-readable access to the configuration file. Consider using more restrictive permissions like 0600 if the config contains sensitive information.

Suggested change

if err := os.WriteFile(configPath, []byte(configText), 0644); err != nil {

if err := os.WriteFile(configPath, []byte(configText), 0600); err != nil {

Copilot · 2025-08-01T18:51:42Z

internal/templates/templates.go

+		return true
+	}
+
+	if !strings.HasSuffix(datafilesPath, `default`) {


The string suffix check for 'default' could match unintended paths like 'mydefault'. Consider using filepath.Base() to check only the directory name, or use a more precise path comparison.

Suggested change

if !strings.HasSuffix(datafilesPath, `default`) {

if filepath.Base(datafilesPath) != `default` {

Volte6 added 2 commits July 27, 2025 14:59

Adding command line args to start new worlds etc

62be9c2

Deleting empty world templates. If template not found, failsover to d…

9f4639d

…efault.

github-advanced-security bot found potential problems Jul 27, 2025

View reviewed changes

Jasrags assigned Volte6 Aug 1, 2025

Jasrags requested a review from Copilot August 1, 2025 18:50

Copilot AI reviewed Aug 1, 2025

View reviewed changes

@@ -232,3 +232,9 @@
-            		fullPath := util.FilePath(datafilesPath, `/`, tplInfo.path)
+            		// Validate and sanitize tplInfo.path to prevent path traversal
+            		cleanPath := filepath.Clean(tplInfo.path)
+            		if strings.Contains(cleanPath, "..") || strings.HasPrefix(cleanPath, "/") || strings.HasPrefix(cleanPath, "\\") {
+            			mudlog.Error("invalid template path", "module", false, "filepath", tplInfo.path)
+            			continue
+            		}
+            		fullPath := util.FilePath(datafilesPath, `/`, cleanPath)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

408 - Create world #423

408 - Create world #423

Uh oh!

Volte6 commented Jul 27, 2025

Uh oh!

Check failure

Copilot Autofix

Check failure

Copilot Autofix

Copilot AI left a comment

Uh oh!

Copilot AI Aug 1, 2025

Uh oh!

Copilot AI Aug 1, 2025

Uh oh!

Copilot AI Aug 1, 2025

Uh oh!

Copilot AI Aug 1, 2025

Uh oh!

Copilot AI Aug 1, 2025

Uh oh!

Uh oh!

-		os.RemoveAll(worldPath)
+		baseWorldDir := filepath.Join("_datafiles", "world")
+		isSafe, err := isSubdirectory(baseWorldDir, worldPath)
+		if err != nil {
+			mudlog.Error("World Creation", "error", "Failed to validate world path for removal: "+err.Error())
+		} else if isSafe {
+			os.RemoveAll(worldPath)
+		} else {
+			mudlog.Error("World Creation", "error", "Unsafe world path detected, not removing: "+worldPath)
+		}

	if err := os.WriteFile(configPath, []byte(configText), 0644); err != nil {
	if err := os.WriteFile(configPath, []byte(configText), 0600); err != nil {

	if !strings.HasSuffix(datafilesPath, `default`) {
	if filepath.Base(datafilesPath) != `default` {

408 - Create world #423

Are you sure you want to change the base?

408 - Create world #423

Uh oh!

Conversation

Volte6 commented Jul 27, 2025

Description

Changes

Links

Uh oh!

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!