[low] Ebook symlinks: '~' in link targets, download TOCTOU #43

New issue

Open

opened 2026-10-18 17:46:55 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 17:46:55 +00:00

Owner

Found by Nye reviewing PR #40 (#27, ebook symlinks). Non-blocking, low.

SafePath realpath uses Path.expand(target, current), which expands a leading ~ in a symlink target to $HOME; POSIX treats it as a literal directory name. Only exploitable if $HOME is inside a library. Fix: for relative targets (Path.type(target) == :relative) use Path.join(current, target) |> Path.expand().
Check-then-send TOCTOU in EbookController.download: the file could be swapped for a symlink between the check and send_download. Needs write access to the library.

FYI, accepted: after a library is deleted, its ebooks under a symlinked mount (like /media) won't download, because of the no-library "no symlinks at all" rule.

Found by Nye reviewing PR #40 (#27, ebook symlinks). Non-blocking, low. 1. `SafePath` realpath uses `Path.expand(target, current)`, which expands a leading `~` in a symlink target to `$HOME`; POSIX treats it as a literal directory name. Only exploitable if `$HOME` is inside a library. Fix: for relative targets (`Path.type(target) == :relative`) use `Path.join(current, target) |> Path.expand()`. 2. Check-then-send TOCTOU in `EbookController.download`: the file could be swapped for a symlink between the check and `send_download`. Needs write access to the library. FYI, accepted: after a library is deleted, its ebooks under a symlinked mount (like /media) won't download, because of the no-library "no symlinks at all" rule.

jfro added the

low

main

security

labels

2026-10-18 17:46:55 +00:00