diff options
| author | Danilo M. <danix@danix.xyz> | 2026-11-02 21:29:50 +0100 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-11-02 21:29:50 +0100 |
| commit | fd3909e16d9f7b2d0cc93ba1d640a361e37748be (patch) | |
| tree | ab691c12d42a8ed524ca09c3a3593a9c99de8284 | |
| parent | a3efcdb11e1dc12555d5d3673220e53f126859f3 (diff) | |
| download | HardenedPass-fd3909e16d9f7b2d0cc93ba1d640a361e37748be.tar.gz HardenedPass-fd3909e16d9f7b2d0cc93ba1d640a361e37748be.zip | |
The check used a string contains on canonical paths, so a typed name
such as ../store-evil/x resolved to a sibling directory whose path
contains the store's and passed. New entries and folder renames could
then land outside the store.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
| -rw-r--r-- | app/src/main/java/app/passwordstore/util/extensions/Extensions.kt | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/app/src/main/java/app/passwordstore/util/extensions/Extensions.kt b/app/src/main/java/app/passwordstore/util/extensions/Extensions.kt index 55a6276e..597a286f 100644 --- a/app/src/main/java/app/passwordstore/util/extensions/Extensions.kt +++ b/app/src/main/java/app/passwordstore/util/extensions/Extensions.kt @@ -33,10 +33,11 @@ fun File.contains(other: File): Boolean { /** * Checks if this [File] is in the password repository directory as given by - * [PasswordRepository.getRepositoryDirectory] + * [PasswordRepository.getRepositoryDirectory]. Compares whole path components, so a sibling such as + * `store-evil` is not inside `store`. */ fun File.isInsideRepository(): Boolean { - return canonicalPath.contains(PasswordRepository.getRepositoryDirectory().canonicalPath) + return canonicalFile.startsWith(PasswordRepository.getRepositoryDirectory().canonicalFile) } /** Recursively lists the files in this [File], skipping any directories it encounters. */ |