Repository navigation
fix(state): escape staterc values so sourcing them is safe - #2198
EnzoItaliano wants to merge 3 commits into
Conversation
staterc.sh wrote values as-is between double quotes, and staterc is read with `source`. A theme name with $(...) or a backtick in it ran as a command, and a single " left the quote open, so sourcing failed and none of the values were set (HyDE-Project#2197). Escape \ " $ and the backtick with a backslash, which is what bash undoes inside double quotes, and refuse a value with a newline. Lua staterc_get() undoes the same escapes, so it reads back what Lua and set_conf() wrote, and reads a line from an older HyDE the way `source` does. Values with none of those characters are written exactly as before.
waybar.py wrote KEY=value with no quotes, so a layout path with a space made `source` run the second word as a command, and $(...) in a value ran (HyDE-Project#2197). Write values the way staterc.sh does: double-quoted, with \ " $ and the backtick escaped, and refuse a value with a newline. get_state_value() undoes the escapes, and still reads an unquoted line from an older waybar.py as it is.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to This change makes values in the state file safe to read with shell source. No concrete merge-blocking risk was identified in the supplied changes. Pre-merge checks |
 |
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely describes the main change: escaping staterc values so Bash sourcing is safe. |
| Linked Issues check | |
The PR addresses direct issue #2197. staterc.sh escapes backslashes, double quotes, $, and backticks before writing KEY="...", and rejects newline or carriage-return values. waybar.py uses the… |
| Out of Scope Changes check | |
The changed files stay within issue #2197. The changelog and comments document the staterc format and the related atomic write behavior. The Lua reader, Python reader, and both writers are necessary f… |
| Docstring Coverage | |
Docstring coverage is 88.89% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 4 files. (1 skipped: 1 u… |
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks the state-file line,
Then tucks each slash in place.
Quotes and backticks lose their bite,
Old lines keep their familiar face.
No newline hops into the file,
The rabbit bounds away with grace.
Comment @coderabbitai help to get the list of available commands.
1 participant
Pull Request
Description
Values in
~/.local/state/hyde/statercwere written without escaping, but scripts read the file withsource(export_hyde_config()inglobalcontrol.sh,fastfetch.sh), so bash interpreted what was inside them (#2197):staterc.sh(used byset_conf()and Lua'sstaterc_set()) wroteKEY="<value>"with the value as-is.theme.switch.shsaves the theme's directory name asHYDE_THEME, so a downloaded theme namedEvil$(cd;touch PWNED)`id`ran both commands every time a script loaded staterc. A single"in a value left the quote open, so sourcing failed and no value was set.waybar.pywroteKEY=<value>without quotes, so a layout path with a space made bash run its second word as a command.This came up in the CodeRabbit review of #2195 (#2195 (comment)); it predates that PR.
Changes:
KEY="<value>"with\,",$and the backtick each escaped by a backslash. That is exactly what bash undoes inside double quotes, sosourcereads back the original value and runs nothing. A value with a newline is refused, since it can't fit on one line.staterc.sh: escapes the value before handing it to awk, and exits 2 for a value with a newline or carriage return.waybar.py:set_state_value()and_add_missing_state_values()write through the new_quote_state_value(), which raisesValueErrorfor a newline.sourcedoes:staterc_get(): strips the quotes and turns\\,\",\$and\`back into the character; any other backslash stays.waybar.pyget_state_value(): does the same through_unquote_state_value().K="back\slash"reads asback\slash, assourcereads it, and an unquotedWAYBAR_LAYOUT_PATH=/x/a b.jsoncreads as-is.Compatibility: a value without any of
\ " $or a backtick is written exactly as before (KEY="value").hydebarandhyde-button, which read staterc by stripping the surrounding quotes, see no difference. The only visible change is thatwaybar.py'sWAYBAR_*lines now get quotes, which both already handle.weather.py's loader only readsWEATHER_*keys, which don't come from staterc.Fixes #2197
Related:
Type of change
Checklist
sh tests/run.shwith testsmainplus test: staterc values are escaped and safe to source tests#41: 60 cases, 0 failed)Testing
HydeVM (clean install, with the staterc files from dev @ 90bffa6 as the baseline): a copy of Catppuccin Mocha named
Evil$(cd;touch PWNED)`id`, applied withtheme.switch.sh -s, then staterc sourced in a new shell.HYDE_THEMElineHYDE_THEME="Evil$(cd;touch PWNED)`id`"HYDE_THEME="Evil\$(cd;touch PWNED)\`id\`"HYDE_THEMEaftersourceEviluid=1000(arch) gid=1000(arch) groups=1000(arch)Evil$(cd;touch PWNED)`id`(exact)~/PWNEDOn the branch, also checked in the same session: switching back to a normal theme,
waybar --set,--next×2 and--prev(the quotedWAYBAR_*lines are read back, the bar stays active),shaders --set, andfastfetch, which sources staterc.shellcheckandluacheckare clean on the changed files, and pre-commit passes.Summary by CodeRabbit