IJHack / QtPass / 41218882575

93%

Build Type

push

github

Committed by web-flow

Commit Message

Init: refuse a folder outside the store (#2096)

* Init: refuse a folder outside the store

pass refuses a path with `..` in it (check_sneaky_paths). Init() did
not: an absolute folder outside the store, or a relative one reached
through `..`, was taken by both backends. ImitatePass wrote that
folder's .gpg-id (only the signed-list folder line stopped it, so not
with signing off); RealPass handed pass --path=/abs/..., which pass
created as a folder under the store.

Pass::refuseFolderOutsideStore() refuses it in both, after the link
checks so a planted link keeps its own message. It shares the emits
with refuseLinkedPath() through refuseAsNotPartOfStore(). RealPass's
--path no longer needs the inside-the-store branch.

No caller passes such a folder today; raised by CodeRabbit and Henk on
#2095, tracked in #2094.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

* chore: update localization source references

make lupdate (generated ui_*.h moved aside first). Brings in the
strings added since #2064, including the one from the previous commit;
one string that left imitatepass.cpp is marked vanished.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

* ImitatePass::Init: write where it checks, past a link and `..`

The link and store checks clean the path they look at; the .gpg-id was
written to the path as given. /store/link/../team/ was checked as
/store/team/, while the system resolved link first and wrote beside the
folder it points to, outside the store. The path is now cleaned before
any check, so the write goes to the folder that was checked.

Predates #2096; found by CodeRabbit there. RealPass already cleans its
folder, and pass gets the store-relative name of it.

Co-Authored-By: Cl... (continued)

Coverage Stats

15 of 15 new or added lines in 3 files covered. (100.0%)

13 existing lines in 2 files now uncovered.

9941 of 10732 relevant lines covered (92.63%)

400.52 hits per line