mirror of
https://github.com/Horizontal42/summarum.git
synced 2026-11-10 23:51:59 +03:00
cb3922c00d
🎯 What: Removed filesystem-level path canonicalization in the DataDirGate check (`canon_or_raw`). ⚠️ Risk: An attacker could bypass directory authorization by creating a symlink to an authorized directory, allowing them to redirect arbitrary path reads/writes via TOCTOU (Time-of-Check to Time-of-Use) attacks or misleading unverified paths. 🛡️ Solution: Replaced `fs::canonicalize` with purely lexical path normalization (resolving `.` and `..` in memory) to ensure strict string match validation without following symlinks. Ensure relative paths with `..` that go above the start are handled securely without dropping components incorrectly. Added proper Iterator methods to appease clippy. Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| capabilities | ||
| icons | ||
| src | ||
| build.rs | ||
| Cargo.lock | ||
| Cargo.toml | ||
| extension-sample.js | ||
| tauri.conf.json | ||
| tauri.linux.conf.json | ||
| tauri.macos.conf.json | ||
| tauri.windows.conf.json | ||