search

flathub / chat.rocket.RocketChat

https://flathub.org/apps/details/chat.rocket.RocketChat
3 stars 9 forks source link

Consider restricting filesystem access #15

Closed lionirdeadman closed 5 years ago

lionirdeadman commented 5 years ago

I think it might be good for security reasons to restrict to $HOME/Pictures and the like instead of giving the entirety of $HOME to avoid security issues that could be had by having access to configuration files.

TingPing commented 5 years ago

It was silently changed here: https://github.com/flathub/chat.rocket.RocketChat/commit/b01ece3e78afd35648ed987491d0438398982d8c

andrevmatos commented 5 years ago

That was because xdg-download were somehow not exposing ~/Downloads folder. I couldn't debug if it was flatpak's fault, electron/gtk file manager or some xdg config issue, but home made the dialog (as well as drag-n-drop of files and download) work again. I'll make new tests with xdg-download again and try to re-restrict it next update. Ideally though I'd rather see https://github.com/electron/electron/issues/2911 and https://github.com/electron/electron/pull/15293 properly implemented.

TingPing commented 5 years ago

That was because xdg-download were somehow not exposing ~/Downloads folder. I couldn't debug if it was flatpak's fault, electron/gtk file manager or some xdg config issue

What does xdg-user-dir DOWNLOAD on the host output?

andrevmatos commented 5 years ago

I didn't have this binary on my Arch system. Installing the respective package provided both a systemd service and the binary, which when run before restarting gave my home, and after, correctly my Downloads dir. Modifying the RocketChat flatpak to use xdg-download now made Downloads folder only to be exposed. So it seems it was some kind of xdg miss-configuration, I didn't read anywhere this package was required for the directory to be exposed. I'll update the package shortly.

andrevmatos commented 5 years ago

Done in 4d8f9af45864da7e7364953eadb5b4f798495198