summaryrefslogtreecommitdiff
path: root/crates/fs-mistrust/src/walk.rs
Commit message (Collapse)AuthorAgeFilesLines
* fix clippy::needless_borrowtrinity-1686a2022-09-101-15/+12
|
* Merge branch 'compact_home_2' into 'main'Nick Mathewson2022-08-311-1/+0
|\ | | | | | | | | | | | | Represent the home directory as ${HOME} or %UserProfile% Closes #555 See merge request tpo/core/arti!700
| * fs-mistrust: Add a `anonymize_home` extension fn for Path.Nick Mathewson2022-08-311-1/+0
| | | | | | | | | | | | This function transforms `/home/nickm/.config` to `${HOME}/.config/`, so that we can expose the username less in our logs.
* | Mark the repeats and looping tests in fs-mistrust as Unix-only.Alexander Færøy2022-08-261-1/+6
| | | | | | | | See: tpo/core/art#557.
* | fs-mistrust: Try to handle verbatim prefixes in test.Nick Mathewson2022-08-261-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We have a test that tries to check that our outputs are the same as those from `std::fs::canonicalize`. But on Windows, they aren't: There, `canonicalize` also puts path prefixes into a "Verbatim" form. This patch tries to replicate that behavior for the test only. If we find that it's unreliable, though, our best bet is probably to revise or disable this check on Windows, rather than chasing compatibility with `GetFinalPathNameByHandle`. Should fix part of #557.
* | fs-mistrust: Clarify comment on `stack`Ian Jackson2022-08-261-0/+2
| |
* | fs-mistrust: Handle windows prefixes specially.Nick Mathewson2022-08-261-11/+50
|/ | | | | | | | | | | | On Windows, paths can have a "prefix", like `C:` or `\\server\share`. Attempts to get metadata for these prefixes appear to fail with `ERROR_INVALID_FUNCTION`, since they are not files. This patch teaches fs-mistrust about prefixes on Windows, and tells it that attempts to find their metadata are allowed to fail. Doing this may solve part of #557.
* fs-mistrust: write a lot about TOCTOU issues.Nick Mathewson2022-05-031-8/+16
|
* fs-mistrust: refactor ResolvePath to avoid temporary changes.Nick Mathewson2022-05-031-36/+31
| | | | | | | | Previously we would temporarily put self.resolved into an invalid state by adding a path component that might be a symlink. With this change, we create a new temporary path object (using Cow to avoid unnecessary allocations) and only conditionally replace self.resolved.
* fs-mistrust: clarify and test behavior for ".." past the fs root.Nick Mathewson2022-05-031-1/+31
|
* Add functionality to inspect directory content permissionsNick Mathewson2022-05-031-1/+3
| | | | Also, explain _why_ this is pretty important.
* Second cut at a fs-mistrust crate.Nick Mathewson2022-05-031-0/+599
This crate is meant to solve #315 by giving a way to make sure that a file or directory is only accessible by trusted users. I've tried to explain carefully (in comments and documentation) what this crate is doing and why, under the assumption that it will someday be read by another person like me who does _not_ live and breathe unix file permissions. The crate is still missing some key features, noted in the TODO section. It differs from the first version of the crate by taking a more principled approach to directory checking: it emulates the path lookup process (reading symlinks and all) one path change at a time, thus ensuring that we check every directory which could enable an untrusted user to get to our target file, _or_ which could enable them to get to any symlink that would get them to the target file. The API is also slightly different: It separates the `Mistrust` object (where you configure what you do or do not trust) from the `Verifier` (where you set up a check that you want to perform on a single object). Verifiers are set up to be a bit ephemeral, so that it is hard to accidentally declare that _every_ object is meant to be readable when you only mean that _some_ objects may be readable.
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-26 23:53:31 +0000