From a2b27dade21f85b68654245efefbd339c3e59584 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Mon, 2 Nov 2026 21:29:50 +0100 Subject: fix(app): compare whole path components in isInsideRepository The check used a string contains on canonical paths, so a typed name such as ../store-evil/x resolved to a sibling directory whose path contains the store's and passed. New entries and folder renames could then land outside the store. Co-Authored-By: Claude Opus 5.5 --- app/src/main/java/app/passwordstore/util/extensions/Extensions.kt | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'app/src/main/java') diff --git a/app/src/main/java/app/passwordstore/util/extensions/Extensions.kt b/app/src/main/java/app/passwordstore/util/extensions/Extensions.kt index 55a6276e..597a286f 100644 --- a/app/src/main/java/app/passwordstore/util/extensions/Extensions.kt +++ b/app/src/main/java/app/passwordstore/util/extensions/Extensions.kt @@ -33,10 +33,11 @@ fun File.contains(other: File): Boolean { /** * Checks if this [File] is in the password repository directory as given by - * [PasswordRepository.getRepositoryDirectory] + * [PasswordRepository.getRepositoryDirectory]. Compares whole path components, so a sibling such as + * `store-evil` is not inside `store`. */ fun File.isInsideRepository(): Boolean { - return canonicalPath.contains(PasswordRepository.getRepositoryDirectory().canonicalPath) + return canonicalFile.startsWith(PasswordRepository.getRepositoryDirectory().canonicalFile) } /** Recursively lists the files in this [File], skipping any directories it encounters. */ -- cgit v1.2.3