Horizontal42/summarum
1
0
Fork 0
mirror of https://github.com/Horizontal42/summarum.git synced 2026-11-11 01:02:01 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(security): prevent arbitrary file system operations in migrate_data_dir

Browse source 
Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com>
This commit is contained in:
google-labs-jules[bot] 2026-08-09 10:47:56 +00:00
parent f6d12097b9
commit 12cd7ce3ca
1 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src-tauri/src/main.rs
View file

@ -18,7 +18,10 @@ struct PickDataDirResult {
} }
#[tauri::command] #[tauri::command]
fn pick_data_dir(app: AppHandle, state: tauri::State<'_, MigrationState>) -> Result<Option<PickDataDirResult>, String> { fn pick_data_dir(
app: AppHandle,
state: tauri::State<'_, MigrationState>,
) -> Result<Option<PickDataDirResult>, String> {
if let Some(p) = app.dialog().file().blocking_pick_folder() { if let Some(p) = app.dialog().file().blocking_pick_folder() {
let path = p.into_path().map_err(|e| e.to_string())?; let path = p.into_path().map_err(|e| e.to_string())?;
let has_docs = path.join("documents.json").exists(); let has_docs = path.join("documents.json").exists();
@ -574,7 +577,9 @@ fn migrate_data_dir(
let approved_dir = state.0.lock().unwrap().take(); let approved_dir = state.0.lock().unwrap().take();
let new = PathBuf::from(&new_dir); let new = PathBuf::from(&new_dir);
if Some(new.clone()) != approved_dir { if Some(new.clone()) != approved_dir {
return Err("Migration rejected: target directory was not explicitly chosen by the user.".into()); return Err(
"Migration rejected: target directory was not explicitly chosen by the user.".into(),
);
} }
let old = docs_dir(&app, &old_dir); let old = docs_dir(&app, &old_dir);