Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),

## Unreleased

### Removed
- Hyprland: dropped the legacy hyprlang dot, the files it deployed no longer exist

### Fixed
- Core: app launchers no longer show a false error when an unrelated `DEBUG` variable contains a non-boolean value such as `release`
- Desktop: the generated battery notification startup command now launches `batterynotify.lua` instead of the removed shell implementation
Expand Down
2 changes: 1 addition & 1 deletion Scripts/dots/fish.toml
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ pacman = ["fish", "starship", "fastfetch"]
action = "sync"
source_root = "Configs/.config/fish"
target_root = "${XDG_CONFIG_HOME}/fish"
paths = ["conf.d", "functions", "completions"]
paths = ["conf.d", "functions"]

[[fish.files]]
action = "preserve"
Expand Down
63 changes: 0 additions & 63 deletions Scripts/dots/hyprland-legacy.toml

This file was deleted.

1 change: 0 additions & 1 deletion Scripts/dots/hyprland.toml
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
[hyprland]
description = "hyprland with lua"
conflicts = ["hyprland_legacy", "hyprland-legacy"]
version = "0.56.1"
pre_command = "hyprctl eval 'hl.config({misc={disable_autoreload=true}})' || true" # Make sure the global run hyprctl reload
post_command = "echo 'Please run 'hyprctl reload' Just incase for errors and to apply the new configuration'"
Expand Down
2 changes: 1 addition & 1 deletion Scripts/dots/swaync.toml
Original file line number Diff line number Diff line change
Expand Up @@ -13,5 +13,5 @@
"swaync",
"waybar/menus/swaync.xml",
"hyde/wallbash/theme/swaync.dcol",
"hyde/wallbash/scripts/swaync.dcol",
"hyde/wallbash/scripts/swaync.sh",
]
2 changes: 1 addition & 1 deletion Scripts/dots/waybar.toml
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,4 @@ paths = ["config.jsonc", "theme.css", "style.css"]
action = "sync"
source_root = "Configs/.local/share/waybar"
target_root = "${XDG_DATA_HOME}/waybar"
paths = ["includes", "scripts", "modules", "styles", "layouts", "menus"]
paths = ["includes", "modules", "styles", "layouts", "menus"]
2 changes: 1 addition & 1 deletion Scripts/dots/zsh.toml
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@
"prompt.zsh",
"plugin.zsh",
".zshrc",
"conf.d/binds",
"conf.d/binds.zsh",
]
source_root = "Configs/.config/zsh"
target_root = "${XDG_CONFIG_HOME}/zsh"
2 changes: 1 addition & 1 deletion tests/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ is adding a file.
| `test_app_wrapper.sh` | Launching through either `app.sh` execution path does not leak an unrelated non-boolean `DEBUG` value into app2unit or xdg-terminal-exec |
| `test_binds.sh` | Loads the Lua keybinds against a stubbed Hyprland API: no two binds share a combination once modifiers are folded to what Hyprland matches on, no keysym sits in a modifier position, no bind uses the `code:NN` form the Lua parser rejects, every bind has a description, every `hyde-shell` command it runs exists. Touchpad gestures are checked in the same pass: a valid finger count, a direction and action Hyprland accepts, and no two gestures on the same finger count and direction |
| `test_git.sh` | The tree holds no gitlink without a matching `.gitmodules` entry, which would break `git submodule` and anything walking submodules |
| `test_dots.sh` | Every installer metafile under `Scripts/dots` parses, declares the keys the installer needs, uses a known action, and points at a source directory that exists. It also keeps Grimblast on the fixed official source |
| `test_dots.sh` | Every installer metafile under `Scripts/dots` parses, declares the keys the installer needs, uses a known action, and points at a source directory and source paths that exist. It also keeps Grimblast on the fixed official source |
Comment thread
coderabbitai[bot] marked this conversation as resolved.
| `test_lua_syntax.sh` | Every shipped Lua file parses |
| `test_schema.sh` | Generated schema artifacts use the current Lua battery notification daemon rather than the removed shell implementation |
| `test_screenshot_wrapper.sh` | Satty receives a compatible default GTK renderer while preserving explicit renderer overrides |
Expand Down
17 changes: 17 additions & 0 deletions tests/python/check_dots.py
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,17 @@
DOTS_DIR = REPO_ROOT / "Scripts" / "dots"


def declared_paths(table: dict) -> list:
"""`paths` is a single string or a list of them."""
paths = table.get("paths", [])
return [paths] if isinstance(paths, str) else list(paths)
Comment thread
coderabbitai[bot] marked this conversation as resolved.


def has_glob(relative: str) -> bool:
"""A pattern is resolved at deploy time, so it cannot be checked here."""
return any(character in relative for character in "*?[")


def inside_repo(relative: str) -> bool:
"""A source path has to stay in the checkout, absolute or `..` included."""
root = REPO_ROOT.resolve()
Expand Down Expand Up @@ -89,6 +100,12 @@ def fail(message: str) -> None:
fail(f"{where} points outside the repository with source_root {source_root!r}")
elif not (REPO_ROOT / source_root).is_dir():
fail(f"{where} points at a missing source_root {source_root!r}")
else:
for relative in declared_paths(table):
if not isinstance(relative, str):
fail(f"{where} declares a path as {type(relative).__name__}, expected a string")
elif not has_glob(relative) and not (REPO_ROOT / source_root / relative).exists():
fail(f"{where} points at a missing path {relative!r}")
Comment on lines +104 to +108

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Constrain declared paths to source_root.

Only source_root is checked with inside_repo; an absolute path or a path containing .. can escape that directory and pass whenever the resulting filesystem entry exists. Resolve each candidate and require it to remain beneath the resolved source root before applying the glob exemption.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/python/check_dots.py` around lines 104 - 108, Update the declared-path
validation loop in declared_paths(table) to resolve each string candidate
relative to the resolved source_root and reject it unless it remains inside that
source-root directory, including rejecting absolute paths and .. traversal.
Perform this containment check before the has_glob(relative) exemption, while
preserving the existing missing-path validation for allowed candidates.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed. Each declared path is resolved against the resolved source root and has to stay under it, checked before the glob exemption. ../../etc/passwd and /etc/passwd are both rejected now.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- Current relevant implementation ---'
sed -n '15,125p' tests/python/check_dots.py

echo
echo '--- Working-tree diff for the validation file ---'
git diff -- tests/python/check_dots.py

Length of output: 4583


@RAprogramm, I can’t verify the fix in the current PR revision: tests/python/check_dots.py still lacks a resolved-path containment check, and there is no diff for that file. It continues to check only path existence after the glob exemption.

Please push or update the commit containing the change, then retry so I can confirm and mark this resolved.

This chat is LLM-generated and may be inaccurate.


for component, table in dependencies(document):
where = f"{name} [{component}.dependency]"
Expand Down
Loading