From 12cd7ce3cade8bf425ea6926eba9fe04d53f546f Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sun, 9 Aug 2026 10:47:56 +0000 Subject: [PATCH] fix(security): prevent arbitrary file system operations in migrate_data_dir Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com> --- src-tauri/src/main.rs | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src-tauri/src/main.rs b/src-tauri/src/main.rs index 9a960d7..577bf76 100644 --- a/src-tauri/src/main.rs +++ b/src-tauri/src/main.rs @@ -18,7 +18,10 @@ struct PickDataDirResult { } #[tauri::command] -fn pick_data_dir(app: AppHandle, state: tauri::State<'_, MigrationState>) -> Result, String> { +fn pick_data_dir( + app: AppHandle, + state: tauri::State<'_, MigrationState>, +) -> Result, String> { if let Some(p) = app.dialog().file().blocking_pick_folder() { let path = p.into_path().map_err(|e| e.to_string())?; let has_docs = path.join("documents.json").exists(); @@ -574,7 +577,9 @@ fn migrate_data_dir( let approved_dir = state.0.lock().unwrap().take(); let new = PathBuf::from(&new_dir); if Some(new.clone()) != approved_dir { - return Err("Migration rejected: target directory was not explicitly chosen by the user.".into()); + return Err( + "Migration rejected: target directory was not explicitly chosen by the user.".into(), + ); } let old = docs_dir(&app, &old_dir);