search

hugolabe / Wike

Wikipedia Reader for the GNOME Desktop
https://hugolabe.github.io/Wike/
GNU General Public License v3.0
228 stars 32 forks source link

Remove filesystem access from the permission of the Flatpak sandbox #147

Open TitouanReal opened 11 months ago

TitouanReal commented 11 months ago

Wike uses the permission '--filesystem=home', giving it access to any file in the home directory of the user. This should not be the case for what this application does, because it doesn't theoretically need a read/write access to the entire home directory.

If some sort of filesystem access is needed by the app, it would be nice to limit this access to the strict necessary, and to try to completely remove this permission in the future.

I couldn't figure out where this access is needed in the code unfortunately. Is it needed by the "Print" feature in some way? Maybe I am completely wrong on this one.

Thanks for considering the issue.

camelCaseNick commented 11 months ago

This would have been fixed by #129 and flathub/com.github.hugolabe.Wike#8.

However, WebKit assumes to have access to the Freedesktop.org user directories' downloads folder and crashes otherwise. Furthermore, WebKit does not simply spawn a file dialogue outside the flatpak's sandbox through a portal, and thus displays the selected file's location as mounted inside the sandbox under /run.

For those issues, there is an upstream bug: https://bugs.webkit.org/show_bug.cgi?id=192748

TitouanReal commented 11 months ago

I am sorry, I searched through the issues but I think I went over the closed ones too fast.

However keeping an issue open regarding this seems reasonable to me, because just fixing the webkit issue upstream will not fix the actual problem referenced here. It will only allow a fix that will need to be done eventually.

pedropaulosuzuki commented 1 month ago

I am sorry, I searched through the issues but I think I went over the closed ones too fast.

However keeping an issue open regarding this seems reasonable to me, because just fixing the webkit issue upstream will not fix the actual problem referenced here. It will only allow a fix that will need to be done eventually.

Webkit seems to have changed the print workflow. Maybe we can take another look at this now.

hugolabe commented 1 month ago

Webkit seems to have changed the print workflow. Maybe we can take another look at this now.

Thanks for letting me know. I'll check it again.