fix: audit LOW fixes — rejection-path tests, wallpaper-fallback docs (v0.9.1)

- Test AccountsService-icon symlink rejection (users.rs)
- Tests for wallpaper symlink/extension/size rejection (config.rs)
- Fix stale 'bundled package wallpaper' fallback docs (README, example config) — bundled tier removed 2026-03-28, actual chain is two-tier

CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.9.1] - 2026-06-17
+
+### Fixed
+
+- Wallpaper fallback docs (README, example config) referenced a removed "bundled package wallpaper" tier; corrected to two-tier (config → moonarch default → CSS background)
+
+### Added
+
+- Tests for avatar/wallpaper rejection paths (AccountsService symlink, wallpaper symlink/extension/size)
+
 ## [0.9.0] - 2026-06-17
 
 ### Changed

Cargo.lock

@@ -616,7 +616,7 @@ dependencies = [
 
 [[package]]
 name = "moonset"
-version = "0.9.0"
+version = "0.9.1"
 dependencies = [
  "dirs",
  "gdk-pixbuf",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "moonset"
-version = "0.9.0"
+version = "0.9.1"
 edition = "2024"
 description = "Wayland session power menu with GTK4 and Layer Shell"
 license = "MIT"

README.md

@@ -60,7 +60,7 @@ background_path = "/usr/share/moonarch/wallpaper.jpg"
 logout_command = "niri msg action quit"
 ```
 
-Wallpaper fallback: config → `/usr/share/moonarch/wallpaper.jpg` → bundled package wallpaper
+Wallpaper fallback: config → `/usr/share/moonarch/wallpaper.jpg` → CSS background (no image)
 
 ## Development
 

config/moonset.toml

@@ -2,7 +2,7 @@
 # Config file: ~/.config/moonset/moonset.toml or /etc/moonset/moonset.toml
 
 # Path to background image (optional)
-# Fallback order: config → /usr/share/moonarch/wallpaper.jpg → bundled package wallpaper
+# Fallback order: config → /usr/share/moonarch/wallpaper.jpg → CSS background (no image)
 # background_path = "/usr/share/moonarch/wallpaper.jpg"
 
 # Logout command override (optional, space-separated program + args)

src/config.rs

@@ -250,6 +250,44 @@ mod tests {
         assert_eq!(result, None);
     }
 
+    #[test]
+    fn resolve_rejects_symlinked_config_wallpaper() {
+        let dir = tempfile::tempdir().unwrap();
+        let target = dir.path().join("real.jpg");
+        fs::write(&target, "fake").unwrap();
+        let link = dir.path().join("link.jpg");
+        std::os::unix::fs::symlink(&target, &link).unwrap();
+        let config = Config {
+            background_path: Some(link.to_str().unwrap().to_string()),
+            ..Config::default()
+        };
+        assert_eq!(resolve_background_path_with(&config, Path::new("/nonexistent")), None);
+    }
+
+    #[test]
+    fn resolve_rejects_disallowed_extension() {
+        let dir = tempfile::tempdir().unwrap();
+        let wp = dir.path().join("wallpaper.bmp");
+        fs::write(&wp, "fake").unwrap();
+        let config = Config {
+            background_path: Some(wp.to_str().unwrap().to_string()),
+            ..Config::default()
+        };
+        assert_eq!(resolve_background_path_with(&config, Path::new("/nonexistent")), None);
+    }
+
+    #[test]
+    fn resolve_rejects_oversized_wallpaper() {
+        let dir = tempfile::tempdir().unwrap();
+        let wp = dir.path().join("huge.jpg");
+        fs::write(&wp, vec![0u8; (MAX_WALLPAPER_FILE_SIZE + 1) as usize]).unwrap();
+        let config = Config {
+            background_path: Some(wp.to_str().unwrap().to_string()),
+            ..Config::default()
+        };
+        assert_eq!(resolve_background_path_with(&config, Path::new("/nonexistent")), None);
+    }
+
     #[test]
     fn load_config_ignores_invalid_toml_syntax() {
         let dir = tempfile::tempdir().unwrap();

src/users.rs

@@ -145,6 +145,20 @@ mod tests {
         assert!(path.is_none());
     }
 
+    #[test]
+    fn rejects_symlink_accountsservice_icon() {
+        let dir = tempfile::tempdir().unwrap();
+        let target = dir.path().join("secret");
+        fs::write(&target, "secret content").unwrap();
+        let icons_dir = dir.path().join("icons");
+        fs::create_dir(&icons_dir).unwrap();
+        let icon = icons_dir.join("testuser");
+        std::os::unix::fs::symlink(&target, &icon).unwrap();
+        // No ~/.face, so resolution falls through to the AccountsService branch
+        let path = get_avatar_path_with(dir.path(), Some("testuser"), &icons_dir);
+        assert!(path.is_none());
+    }
+
     #[test]
     fn returns_none_when_no_avatar() {
         let dir = tempfile::tempdir().unwrap();