diff options
| author | Danilo M. <danix@danix.xyz> | 2026-11-02 21:29:50 +0100 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-11-02 21:29:50 +0100 |
| commit | fd3909e16d9f7b2d0cc93ba1d640a361e37748be (patch) | |
| tree | ab691c12d42a8ed524ca09c3a3593a9c99de8284 /app/src/main/java/dev/msfjarvis/aps/injection/totp | |
| parent | a3efcdb11e1dc12555d5d3673220e53f126859f3 (diff) | |
| download | HardenedPass-fd3909e16d9f7b2d0cc93ba1d640a361e37748be.tar.gz HardenedPass-fd3909e16d9f7b2d0cc93ba1d640a361e37748be.zip | |
fix(app): compare whole path components in isInsideRepository
The check used a string contains on canonical paths, so a typed name
such as ../store-evil/x resolved to a sibling directory whose path
contains the store's and passed. New entries and folder renames could
then land outside the store.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'app/src/main/java/dev/msfjarvis/aps/injection/totp')
0 files changed, 0 insertions, 0 deletions