Repository navigation
Security fixes, and Rust crates instead of programs and hand-written parsers - #4
Merged
Merged
Conversation
…ecurity audit's findings Security (from the audit): - git ran repository-chosen programs on file open (core.fsmonitor), in the explorer (clean filters), the commit pickers (textconv) and git log/show (gpg.program). git is now read with gix, which takes filter and diff drivers only from the user's and the system's config, never from the opened folder's .git/config. - The pickers, the reload after a shell command and the statusline's .git/HEAD read only regular files, with bounded reads: a FIFO or a symlink to /dev/zero no longer hangs or exhausts lim. - Panic backups and save temp files are new files, owner-only (0600), and a link planted at their name is not followed. - Bidi controls are drawn as `?`; the Windows clipboard read is bounded. Crates for what lim did with programs or by hand: - gix for git (gitsigns base, status, file list, log/graph, show, stash, browse) in src/repo.rs; imara-diff (through gix) for gitsigns. - syntect with bat's grammars (two-face) for highlighting; pulldown-cmark for the Markdown preview; jsonc-parser for the config. - ureq with rustls for the update's HTTPS (no libcurl or WinHTTP FFI). - arboard for the clipboard, open for the default app. - data-encoding, percent-encoding, sha2, getrandom and jiff for the text tools' encodings, hashes, random bytes and time zones. Dependencies are optimized in debug builds so the perf budgets hold in `cargo test`. The old explorer passed `git status --relative`, which git rejects, so it never showed statuses; it does now.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security fixes from an audit, and Rust crates in place of external programs and hand-written parsers.
Security
gitinside the opened folder, and git obeys that folder's.git/config:core.fsmonitorran on every file open, a clean filter in the explorer,textconvin the commit pickers,gpg.programin git log/show. A project delivered as an archive or a copied checkout could run any command as the user. git is now read with gix, which never takes filter or diff drivers from the folder's own config..git/HEADread only regular files, with bounded reads.?(no "Trojan Source" reordering); the Windows clipboard read is bounded by the block size.Crates instead of programs or hand-written code
gitprocessessrc/repo.rs)dlopen) / WinHTTP FFI/dev/urandom,RtlGenRandom,localtime_r,GetTimeZoneInformationFixed on the way: the explorer passed
git status --relative, which git rejects, so it never showed statuses.Measured
Windows, same 3000-file repository, median of 20 runs:
The perf budgets hold in debug and release; lim still beats Neovim on every
vs_neovimoperation. Costs: syntect highlighting is slower than the keyword lists (typing 500 chars with a frame per key: 125 → 356 ms in release, budget 4000 ms); the binary grows from about 2 MB to about 7 MB; a clean release build takes about 3x longer.Limits
syntax sync minlines): a block comment opened further up is missed until scrolled through. Lines over 20,000 bytes are drawn plain..ps1files are not colored.Checks
cargo clippy --all-targets: 0 warnings on Windows and Linux (WSL).cargo test: 158/158 on Windows, 161/161 on Linux, perf budgets included.vs_neovim: lim faster on every row.