diff options
| author | Danilo M. <danix@danix.xyz> | 2026-11-02 21:29:50 +0100 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-11-02 21:29:51 +0100 |
| commit | a2b27dade21f85b68654245efefbd339c3e59584 (patch) | |
| tree | 0fb83722f46c6abe7612af6293b3b1c8e1895948 /app/src | |
| parent | 32ee99b3243da8c55428538b326b159d03f93f6c (diff) | |
| download | HardenedPass-a2b27dade21f85b68654245efefbd339c3e59584.tar.gz HardenedPass-a2b27dade21f85b68654245efefbd339c3e59584.zip | |
fix(app): compare whole path components in isInsideRepository
The check used a string contains on canonical paths, so a typed name
such as ../store-evil/x resolved to a sibling directory whose path
contains the store's and passed. New entries and folder renames could
then land outside the store.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'app/src')
| -rw-r--r-- | app/src/main/java/app/passwordstore/util/extensions/Extensions.kt | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/app/src/main/java/app/passwordstore/util/extensions/Extensions.kt b/app/src/main/java/app/passwordstore/util/extensions/Extensions.kt index 55a6276e..597a286f 100644 --- a/app/src/main/java/app/passwordstore/util/extensions/Extensions.kt +++ b/app/src/main/java/app/passwordstore/util/extensions/Extensions.kt @@ -33,10 +33,11 @@ fun File.contains(other: File): Boolean { /** * Checks if this [File] is in the password repository directory as given by - * [PasswordRepository.getRepositoryDirectory] + * [PasswordRepository.getRepositoryDirectory]. Compares whole path components, so a sibling such as + * `store-evil` is not inside `store`. */ fun File.isInsideRepository(): Boolean { - return canonicalPath.contains(PasswordRepository.getRepositoryDirectory().canonicalPath) + return canonicalFile.startsWith(PasswordRepository.getRepositoryDirectory().canonicalFile) } /** Recursively lists the files in this [File], skipping any directories it encounters. */ |