From 510d45a9b14179ca9e4b76a15cd23c9c44a871ec Mon Sep 17 00:00:00 2001
From: nevaforget <dom@moonarch.de>
Date: Wed, 17 Jun 2026 13:06:15 +0200
Subject: [PATCH] =?UTF-8?q?fix:=20audit=20LOW=20fixes=20=E2=80=94=20reject?=
 =?UTF-8?q?ion-path=20tests,=20wallpaper-fallback=20docs=20(v0.9.1)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Test AccountsService-icon symlink rejection (users.rs)
- Tests for wallpaper symlink/extension/size rejection (config.rs)
- Fix stale 'bundled package wallpaper' fallback docs (README, example config) — bundled tier removed 2026-03-28, actual chain is two-tier
---
 CHANGELOG.md        | 10 ++++++++++
 Cargo.lock          |  2 +-
 Cargo.toml          |  2 +-
 README.md           |  2 +-
 config/moonset.toml |  2 +-
 src/config.rs       | 38 ++++++++++++++++++++++++++++++++++++++
 src/users.rs        | 14 ++++++++++++++
 7 files changed, 66 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 59497db..ea1ed83 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.9.1] - 2026-06-17
+
+### Fixed
+
+- Wallpaper fallback docs (README, example config) referenced a removed "bundled package wallpaper" tier; corrected to two-tier (config → moonarch default → CSS background)
+
+### Added
+
+- Tests for avatar/wallpaper rejection paths (AccountsService symlink, wallpaper symlink/extension/size)
+
 ## [0.9.0] - 2026-06-17
 
 ### Changed
diff --git a/Cargo.lock b/Cargo.lock
index a7ef207..c064a50 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -616,7 +616,7 @@ dependencies = [
 
 [[package]]
 name = "moonset"
-version = "0.9.0"
+version = "0.9.1"
 dependencies = [
  "dirs",
  "gdk-pixbuf",
diff --git a/Cargo.toml b/Cargo.toml
index b8e90e2..76c9024 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "moonset"
-version = "0.9.0"
+version = "0.9.1"
 edition = "2024"
 description = "Wayland session power menu with GTK4 and Layer Shell"
 license = "MIT"
diff --git a/README.md b/README.md
index 90c254b..6f93726 100644
--- a/README.md
+++ b/README.md
@@ -60,7 +60,7 @@ background_path = "/usr/share/moonarch/wallpaper.jpg"
 logout_command = "niri msg action quit"
 ```
 
-Wallpaper fallback: config → `/usr/share/moonarch/wallpaper.jpg` → bundled package wallpaper
+Wallpaper fallback: config → `/usr/share/moonarch/wallpaper.jpg` → CSS background (no image)
 
 ## Development
 
diff --git a/config/moonset.toml b/config/moonset.toml
index 8c99f09..d80240c 100644
--- a/config/moonset.toml
+++ b/config/moonset.toml
@@ -2,7 +2,7 @@
 # Config file: ~/.config/moonset/moonset.toml or /etc/moonset/moonset.toml
 
 # Path to background image (optional)
-# Fallback order: config → /usr/share/moonarch/wallpaper.jpg → bundled package wallpaper
+# Fallback order: config → /usr/share/moonarch/wallpaper.jpg → CSS background (no image)
 # background_path = "/usr/share/moonarch/wallpaper.jpg"
 
 # Logout command override (optional, space-separated program + args)
diff --git a/src/config.rs b/src/config.rs
index 5d3ddd1..871ac78 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -250,6 +250,44 @@ mod tests {
         assert_eq!(result, None);
     }
 
+    #[test]
+    fn resolve_rejects_symlinked_config_wallpaper() {
+        let dir = tempfile::tempdir().unwrap();
+        let target = dir.path().join("real.jpg");
+        fs::write(&target, "fake").unwrap();
+        let link = dir.path().join("link.jpg");
+        std::os::unix::fs::symlink(&target, &link).unwrap();
+        let config = Config {
+            background_path: Some(link.to_str().unwrap().to_string()),
+            ..Config::default()
+        };
+        assert_eq!(resolve_background_path_with(&config, Path::new("/nonexistent")), None);
+    }
+
+    #[test]
+    fn resolve_rejects_disallowed_extension() {
+        let dir = tempfile::tempdir().unwrap();
+        let wp = dir.path().join("wallpaper.bmp");
+        fs::write(&wp, "fake").unwrap();
+        let config = Config {
+            background_path: Some(wp.to_str().unwrap().to_string()),
+            ..Config::default()
+        };
+        assert_eq!(resolve_background_path_with(&config, Path::new("/nonexistent")), None);
+    }
+
+    #[test]
+    fn resolve_rejects_oversized_wallpaper() {
+        let dir = tempfile::tempdir().unwrap();
+        let wp = dir.path().join("huge.jpg");
+        fs::write(&wp, vec![0u8; (MAX_WALLPAPER_FILE_SIZE + 1) as usize]).unwrap();
+        let config = Config {
+            background_path: Some(wp.to_str().unwrap().to_string()),
+            ..Config::default()
+        };
+        assert_eq!(resolve_background_path_with(&config, Path::new("/nonexistent")), None);
+    }
+
     #[test]
     fn load_config_ignores_invalid_toml_syntax() {
         let dir = tempfile::tempdir().unwrap();
diff --git a/src/users.rs b/src/users.rs
index 9804fef..80dcf6e 100644
--- a/src/users.rs
+++ b/src/users.rs
@@ -145,6 +145,20 @@ mod tests {
         assert!(path.is_none());
     }
 
+    #[test]
+    fn rejects_symlink_accountsservice_icon() {
+        let dir = tempfile::tempdir().unwrap();
+        let target = dir.path().join("secret");
+        fs::write(&target, "secret content").unwrap();
+        let icons_dir = dir.path().join("icons");
+        fs::create_dir(&icons_dir).unwrap();
+        let icon = icons_dir.join("testuser");
+        std::os::unix::fs::symlink(&target, &icon).unwrap();
+        // No ~/.face, so resolution falls through to the AccountsService branch
+        let path = get_avatar_path_with(dir.path(), Some("testuser"), &icons_dir);
+        assert!(path.is_none());
+    }
+
     #[test]
     fn returns_none_when_no_avatar() {
         let dir = tempfile::tempdir().unwrap();