Re: [PATCH v2] Unveil patch

Hi,

On Mon, Aug 05, 2024 at 05:42:54PM +0200, [email protected] wrote:
>Hi Rodrigo,
>
>On Mon, 5 Aug 2024 15:06:04 +0200
>Rodrigo Arias <[email protected]> wrote:
>
>> >> I think we could just not allow $HOME to be set as save_dir (or any
>> >> directory that contains $HOME, like /home) and refuse to start if
>> >> this is the case.
>
>Sorry, I guess this is the part that confused me:
>"(or any directory that contains $HOME, like /home)"
>
>I agree with it, just not sure how to implement while still allowing a
>save_dir like '$HOME/Downloads', or '/home/user/Downloads'.
>
>Maybe it's a simple thing, but any help would be appreciated!

By "contains" I mean that $HOME cannot be inside save_dir:

bad: save_dir=/
bad: save_dir=/home
bad: save_dir=/home/<theuser>
ok: save_dir=/home/<theuser>/foo
ok: save_dir=/tmp

Here is a very simple check (doesn't handle /../ and other problems):

   const char *home = dGethomedir();
   const char *save = prefs.save_dir;
   int nsave = strlen(save);
   int nhome = strlen(home);

   if (nsave <= nhome) {
      /* Prevent save_dir="/home" and save_dir=$HOME */
      if (strncmp(save, home, nsave) == 0) {
         MSG("save_dir cannot contain home\n");
         exit(1);
      }
   }

Best,
Rodrigo.
_______________________________________________
Dillo-dev mailing list -- dillo-dev-lx9mn2B4QYRWk0Htik3J/[email protected]
To unsubscribe send an email to dillo-dev-leave-lx9mn2B4QYRWk0Htik3J/[email protected]