0 Releases 21 Tags

RSS Feed

• v0.6.19 9d7f39fe05

  Compare

  fix: harden avatar load against symlink TOCTOU (v0.6.19)

  nevaforget released this 2026-06-17 11:53:46 +02:00 | 0 commits to main since this release

  SEC-01 (security audit, LOW): the avatar load followed symlinks via
  gio::File while the wallpaper load was already O_NOFOLLOW-hardened — the
  project's lock-path hardening was applied inconsistently. Share one
  read_file_nofollow loader for both file reads so they cannot diverge
  again; a symlinked ~/.face now fails open with ELOOP and falls back to
  the default avatar. Adds loader unit tests (regular file, symlink->ELOOP).

  Bundles clippy cleanup: c"" literal in auth.rs, let-chains, drop
  redundant gtk4_session_lock import, blur guard via .filter() (unifies
  with moongreet/moonset).

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)