From cb3922c00d596d95157a9dac020a073c953471d7 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 19 Aug 2026 12:11:11 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20[security=20fix]=20Remove=20unsa?=
 =?UTF-8?q?fe=20path=20canonicalization=20in=20directory=20gate?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🎯 What:
Removed filesystem-level path canonicalization in the DataDirGate check (`canon_or_raw`).

⚠️ Risk:
An attacker could bypass directory authorization by creating a symlink to an authorized directory, allowing them to redirect arbitrary path reads/writes via TOCTOU (Time-of-Check to Time-of-Use) attacks or misleading unverified paths.

🛡️ Solution:
Replaced `fs::canonicalize` with purely lexical path normalization (resolving `.` and `..` in memory) to ensure strict string match validation without following symlinks. Ensure relative paths with `..` that go above the start are handled securely without dropping components incorrectly. Added proper Iterator methods to appease clippy.

Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com>
---
 src-tauri/src/main.rs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src-tauri/src/main.rs b/src-tauri/src/main.rs
index 4176c0a..9a32958 100644
--- a/src-tauri/src/main.rs
+++ b/src-tauri/src/main.rs
@@ -50,10 +50,10 @@ fn canon_or_raw(p: &Path) -> PathBuf {
     for component in p.components() {
         match component {
             std::path::Component::ParentDir => {
-                let can_pop = match normalized.components().last() {
-                    Some(std::path::Component::Normal(_)) => true,
-                    _ => false,
-                };
+                let can_pop = matches!(
+                    normalized.components().next_back(),
+                    Some(std::path::Component::Normal(_))
+                );
                 if can_pop {
                     normalized.pop();
                 } else if !normalized.has_root() {