aboutsummaryrefslogtreecommitdiff
path: root/crates/fs-mistrust/src/walk.rs
Commit message (Collapse)AuthorAgeFilesLines
* maint: Run maint/add_warning to deny string slicesClara Engler2026-06-091-0/+1
| | | | | | | | | | | | This commit executes maint/add_warning with the just added change to deny string slices except in tests. I recommend auditing this by checking out the previous commit followed by running the script yourself and then verifying that the diff is identical to this commit. This commit makes cargo clippy fail. We will add exceptions in the next commit.
* fs-mistrust: Treat "" as a NotFound Path.Nick Mathewson2025-11-241-0/+3
| | | | | | | | | This makes fs-mistrust consistent with stat() and mkdir() and friends, which consider "" to be an invalid path. Previously, "" was accepted whenever mistrust was enabled, but rejected whenever mistrust was disabled. Closes #2265.
* Fix name of clippy lint to unchecked_time_subtraction (2)Ian Jackson2025-11-061-1/+1
| | | | Run maint/add_warning
* *: use std::io::Error::other in many placesNick Mathewson2025-05-151-4/+2
| | | | | | | The `IoError::other` function is an easier way to say `IoError::new(IoErrorKind::Other, ...)`. It's been around since 1.74, but clippy started warning about the more verbose version in 1.87.
* fix builds for AndroidYaksh Bariya2025-03-031-0/+1
| | | | | | | This does fix builds for both the arti binary and the tests. Most tests seem to be passing, some are failing. I will try to investigate them and send fixes/create issue to highlight them. Hopefully this helps arti in being production ready fast.
* Replace _ => panic!() elsewhereIan Jackson2024-10-151-1/+1
|
* Fix a footnote reference that Nightly complains aboutIan Jackson2024-07-081-1/+1
|
* Run maint/add_warning.Nick Mathewson2024-03-131-0/+1
|
* Fix typos in commentsTobias Stoeckmann2024-03-061-1/+1
|
* Run maint/add_warning to add lint block everywhereIan Jackson2023-08-231-0/+1
|
* fs-mistrust: Replace a direct libc call in a testIan Jackson2023-07-141-1/+1
|
* Run maint/add_warning to actually apply new lint allowsIan Jackson2023-07-101-0/+1
|
* Allow clippy::unchecked_duration_subtraction in testsNick Mathewson2023-01-271-0/+1
| | | | | This panics on error, and we're fine with a panic on misbehavior in tests.
* test lint blocks: Add many many automaticallyIan Jackson2022-12-121-0/+8
| | | | | This is precisely the result of running the rune in maint/adhoc-add-lint-blocks.
* fix clippy::needless_borrowtrinity-1686a2022-09-101-15/+12
|
* Merge branch 'compact_home_2' into 'main'Nick Mathewson2022-08-311-1/+0
|\ | | | | | | | | | | | | Represent the home directory as ${HOME} or %UserProfile% Closes #555 See merge request tpo/core/arti!700
| * fs-mistrust: Add a `anonymize_home` extension fn for Path.Nick Mathewson2022-08-311-1/+0
| | | | | | | | | | | | This function transforms `/home/nickm/.config` to `${HOME}/.config/`, so that we can expose the username less in our logs.
* | Mark the repeats and looping tests in fs-mistrust as Unix-only.Alexander Færøy2022-08-261-1/+6
| | | | | | | | See: tpo/core/art#557.
* | fs-mistrust: Try to handle verbatim prefixes in test.Nick Mathewson2022-08-261-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We have a test that tries to check that our outputs are the same as those from `std::fs::canonicalize`. But on Windows, they aren't: There, `canonicalize` also puts path prefixes into a "Verbatim" form. This patch tries to replicate that behavior for the test only. If we find that it's unreliable, though, our best bet is probably to revise or disable this check on Windows, rather than chasing compatibility with `GetFinalPathNameByHandle`. Should fix part of #557.
* | fs-mistrust: Clarify comment on `stack`Ian Jackson2022-08-261-0/+2
| |
* | fs-mistrust: Handle windows prefixes specially.Nick Mathewson2022-08-261-11/+50
|/ | | | | | | | | | | | On Windows, paths can have a "prefix", like `C:` or `\\server\share`. Attempts to get metadata for these prefixes appear to fail with `ERROR_INVALID_FUNCTION`, since they are not files. This patch teaches fs-mistrust about prefixes on Windows, and tells it that attempts to find their metadata are allowed to fail. Doing this may solve part of #557.
* fs-mistrust: write a lot about TOCTOU issues.Nick Mathewson2022-05-031-8/+16
|
* fs-mistrust: refactor ResolvePath to avoid temporary changes.Nick Mathewson2022-05-031-36/+31
| | | | | | | | Previously we would temporarily put self.resolved into an invalid state by adding a path component that might be a symlink. With this change, we create a new temporary path object (using Cow to avoid unnecessary allocations) and only conditionally replace self.resolved.
* fs-mistrust: clarify and test behavior for ".." past the fs root.Nick Mathewson2022-05-031-1/+31
|
* Add functionality to inspect directory content permissionsNick Mathewson2022-05-031-1/+3
| | | | Also, explain _why_ this is pretty important.
* Second cut at a fs-mistrust crate.Nick Mathewson2022-05-031-0/+599
This crate is meant to solve #315 by giving a way to make sure that a file or directory is only accessible by trusted users. I've tried to explain carefully (in comments and documentation) what this crate is doing and why, under the assumption that it will someday be read by another person like me who does _not_ live and breathe unix file permissions. The crate is still missing some key features, noted in the TODO section. It differs from the first version of the crate by taking a more principled approach to directory checking: it emulates the path lookup process (reading symlinks and all) one path change at a time, thus ensuring that we check every directory which could enable an untrusted user to get to our target file, _or_ which could enable them to get to any symlink that would get them to the target file. The API is also slightly different: It separates the `Mistrust` object (where you configure what you do or do not trust) from the `Verifier` (where you set up a check that you want to perform on a single object). Verifiers are set up to be a bit ephemeral, so that it is hard to accidentally declare that _every_ object is meant to be readable when you only mean that _some_ objects may be readable.
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-26 22:10:57 +0000