address review: check the original Path for the dictionary write; isolate the confinement test

crates/engine/src/file_access.rs

@@ -85,14 +85,20 @@ impl AutomationRoots {
 
     /// May the file or folder at `path` be read (or written)? `Err` says why not.
     pub fn check(&self, path: &str, access: Access) -> Result<(), String> {
+        self.check_path(Path::new(path), access)
+    }
+
+    /// [`Self::check`] for a path that may not be UTF-8: the checked path is the one opened.
+    pub fn check_path(&self, path: &Path, access: Access) -> Result<(), String> {
+        let path_text = path.display();
         let roots = match access {
             Access::Read => &self.read,
             Access::Write => &self.write,
         };
         if roots.is_empty() {
             return match access {
-                Access::Read => Err(format!("automation filesystem access is not granted: read authority is absent: {path}")),
-                Access::Write => Err(format!("automation filesystem access is not granted: write authority is absent: {path}")),
+                Access::Read => Err(format!("automation filesystem access is not granted: read authority is absent: {path_text}")),
+                Access::Write => Err(format!("automation filesystem access is not granted: write authority is absent: {path_text}")),
             };
         }
         let resolved = resolve(path)?;
@@ -101,8 +107,8 @@ impl AutomationRoots {
         }
         let roots = roots.iter().map(|root| root.shown.display().to_string()).collect::<Vec<_>>().join(", ");
         match access {
-            Access::Read => Err(format!("automation path rejected: outside the read roots {roots}: {path}")),
-            Access::Write => Err(format!("automation path rejected: outside the write roots {roots}: {path}")),
+            Access::Read => Err(format!("automation path rejected: outside the read roots {roots}: {path_text}")),
+            Access::Write => Err(format!("automation path rejected: outside the write roots {roots}: {path_text}")),
         }
     }
 }
@@ -191,17 +197,23 @@ pub fn check_write(path: &str) -> Result<(), String> {
     current().map_or(Ok(()), |r| r.check(path, Access::Write))
 }
 
+/// May `path` be written here? Always, without roots in force. For a path that may not be UTF-8.
+pub fn check_write_path(path: &Path) -> Result<(), String> {
+    current().map_or(Ok(()), |r| r.check_path(path, Access::Write))
+}
+
 /// `path` made absolute with its links followed; for a path that doesn't exist (yet), its nearest
 /// existing folder's links followed and the rest appended.
-fn resolve(path: &str) -> Result<PathBuf, String> {
-    if path.is_empty() {
+fn resolve(path: &Path) -> Result<PathBuf, String> {
+    if path.as_os_str().is_empty() {
         return Err("automation path rejected: path is empty".into());
     }
+    let shown = path.display();
     // Checked as given: making `…\NUL` absolute gives the device path `\\.\NUL` on Windows.
-    if cfg!(windows) && Path::new(path).components().any(|c| matches!(c, Component::Normal(n) if is_device_name(&n.to_string_lossy()))) {
-        return Err(format!("automation path rejected: reserved device names are not allowed: {path}"));
+    if cfg!(windows) && path.components().any(|c| matches!(c, Component::Normal(n) if is_device_name(&n.to_string_lossy()))) {
+        return Err(format!("automation path rejected: reserved device names are not allowed: {shown}"));
     }
-    let absolute = std::path::absolute(path).map_err(|e| format!("automation path rejected: cannot resolve {path}: {e}"))?;
+    let absolute = std::path::absolute(path).map_err(|e| format!("automation path rejected: cannot resolve {shown}: {e}"))?;
     // The names below the nearest existing folder, last first.
     let mut missing: Vec<OsString> = vec![];
     let mut at = absolute.as_path();
@@ -212,11 +224,11 @@ fn resolve(path: &str) -> Result<PathBuf, String> {
                 return Ok(found);
             }
             Err(e) => match std::fs::symlink_metadata(at) {
-                Ok(m) if m.file_type().is_symlink() => return Err(format!("automation path rejected: a link that leads nowhere: {path}")),
+                Ok(m) if m.file_type().is_symlink() => return Err(format!("automation path rejected: a link that leads nowhere: {shown}")),
                 // There, yet its real path can't be had (no permission): nothing to compare.
-                Ok(_) => return Err(format!("automation path rejected: cannot resolve {path}: {e}")),
+                Ok(_) => return Err(format!("automation path rejected: cannot resolve {shown}: {e}")),
                 Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
-                Err(e) => return Err(format!("automation path rejected: cannot resolve {path}: {e}")),
+                Err(e) => return Err(format!("automation path rejected: cannot resolve {shown}: {e}")),
             },
         }
         let parent = at.parent();
@@ -226,12 +238,12 @@ fn resolve(path: &str) -> Result<PathBuf, String> {
                 at = parent;
             }
             (Some(Component::ParentDir), _) => {
-                return Err(format!("automation path rejected: parent traversal below a folder that doesn't exist: {path}"));
+                return Err(format!("automation path rejected: parent traversal below a folder that doesn't exist: {shown}"));
             }
             // Down to the root (or drive) and it doesn't exist either.
             _ => {
                 let e = std::io::Error::from(std::io::ErrorKind::NotFound);
-                return Err(format!("automation path rejected: cannot resolve {path}: {e}"));
+                return Err(format!("automation path rejected: cannot resolve {shown}: {e}"));
             }
         }
     }

crates/engine/src/lib.rs

@@ -811,32 +811,10 @@ fn clamp_selection(st: &mut DocState) {
 /// Default for [`History::byte_limit`].
 pub const UNDO_BYTE_BUDGET: usize = 256 << 20;
 
-/// A rough size of a text body in memory: its paragraphs and runs, at their inline struct sizes.
-fn text_cost(t: &deckcraft_model::text::TextBody) -> usize {
-    use deckcraft_model::text::{Paragraph, Run};
-    let (para, run) = (std::mem::size_of::<Paragraph>(), std::mem::size_of::<Run>());
-    t.paragraphs.iter().map(|p| para + p.runs.iter().map(|r| run + r.text.len()).sum::<usize>()).sum()
-}
-
-/// A rough size of comments in memory, replies included.
-fn comments_cost(cs: &[deckcraft_model::Comment], depth: usize) -> usize {
-    let kids = |c: &deckcraft_model::Comment| if depth < 64 { comments_cost(&c.replies, depth + 1) } else { 0 };
-    cs.iter().map(|c| 256 + c.author.len() + c.initials.len() + c.text.len() + c.date.len() + kids(c)).sum()
-}
-
-/// A rough size of a slide's own data besides its shapes: notes, comments, tags and kept XML,
-/// all copied with the slide when an edit changes it.
-fn slide_extra_cost(s: &deckcraft_model::Slide) -> usize {
-    text_cost(&s.notes)
-        + comments_cost(&s.comments, 0)
-        + s.name.len()
-        + s.tags.iter().map(|(k, v)| 48 + k.len() + v.len()).sum::<usize>()
-        + s.raw_ext.as_ref().map_or(0, String::len)
-}
-
 /// A rough size of a shape in memory: the struct, its text and kept XML, its children.
 fn shape_cost(sh: &deckcraft_model::Shape, depth: usize) -> usize {
-    let text: usize = sh.text.as_ref().map_or(0, text_cost);
+    let text: usize =
+        sh.text.as_ref().map_or(0, |t| t.paragraphs.iter().map(|p| 96 + p.runs.iter().map(|r| 128 + r.text.len()).sum::<usize>()).sum());
     let kids: usize = if depth < 64 { sh.children().iter().map(|c| shape_cost(c, depth + 1)).sum() } else { 0 };
     768 + text + sh.raw_ext.as_ref().map_or(0, String::len) + kids
 }
@@ -854,7 +832,7 @@ pub fn undo_cost(doc: &Presentation, newer: &Presentation) -> usize {
     let media: HashSet<*const Vec<u8>> = newer.media.iter().map(|m| Arc::as_ptr(&m.data)).collect();
     let mut n = 64 * doc.slides.len();
     for s in doc.slides.iter().filter(|s| !slides.contains(&Arc::as_ptr(s))) {
-        n += 512 + shapes_cost(&s.shapes) + slide_extra_cost(s);
+        n += 512 + shapes_cost(&s.shapes);
     }
     for m in doc.masters.iter().filter(|m| !masters.contains(&Arc::as_ptr(m))) {
         n += 4096 + shapes_cost(&m.shapes) + m.layouts.iter().map(|l| 512 + shapes_cost(&l.shapes)).sum::<usize>();

crates/engine/src/spell.rs

@@ -668,6 +668,8 @@ pub fn add_user_word(word: &str) -> std::io::Result<()> {
         return Ok(());
     }
     let path = user_dictionary_path().ok_or_else(|| std::io::Error::new(std::io::ErrorKind::NotFound, "no folder for the user dictionary"))?;
+    // A confined automation client may write only inside its write roots, this file included.
+    crate::file_access::check_write_path(&path).map_err(|e| std::io::Error::new(std::io::ErrorKind::PermissionDenied, e))?;
     if let Some(d) = path.parent() {
         std::fs::create_dir_all(d)?;
     }
@@ -953,6 +955,20 @@ SFX D Y 1\nSFX D 0 ed/S .\n";
         assert_eq!(w, vec!["check", "done"]);
     }
 
+    #[test]
+    fn a_confined_client_cannot_write_the_user_dictionary_outside_its_roots() {
+        let root = std::env::temp_dir().join(format!("deckcraft-dict-root-{}", std::process::id()));
+        std::fs::create_dir_all(&root).unwrap();
+        let roots = crate::file_access::AutomationRoots::new(std::slice::from_ref(&root), std::slice::from_ref(&root)).unwrap();
+        // The user dictionary is a file of its own outside `root`, not whatever HOME points at.
+        let outside = std::env::temp_dir().join(format!("deckcraft-dict-outside-{}", std::process::id()));
+        set_user_dictionary_path(outside.join("user.dic"));
+        let r = crate::file_access::confine(roots.as_ref(), || add_user_word("zqxconfinedword"));
+        assert_eq!(r.map_err(|e| e.kind()), Err(std::io::ErrorKind::PermissionDenied));
+        assert!(!outside.exists(), "the refused write created nothing");
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
     #[test]
     fn long_and_numeric_flags_and_latin1() {
         let d = Dictionary::parse(b"FLAG long\nSFX Aa Y 1\nSFX Aa 0 s .\n", b"1\ncat/Aa\n");

crates/engine/src/tests.rs

@@ -3338,25 +3338,6 @@ fn undo_history_is_capped_by_memory_as_well_as_steps() {
     assert_eq!(s.doc().unwrap().history.undo.len(), 120);
 }
 
-/// A slide's notes count toward the undo budget: small edits to a slide with large notes keep a
-/// copy of those notes per step, and must not slip past the budget as if the slide were empty.
-#[test]
-fn undo_history_counts_slide_notes() {
-    let mut s = Session::with_new();
-    let notes = "n".repeat(1 << 20);
-    s.edit(|doc, _| {
-        std::sync::Arc::make_mut(&mut doc.slides[0]).notes = deckcraft_model::text::TextBody::from_text(&notes);
-        Ok(())
-    })
-    .unwrap();
-    s.doc_mut().unwrap().history = History { limit: 500, byte_limit: 8 << 20, ..Default::default() };
-    for i in 0..40 {
-        s.execute("slide.rename", &json!({"name": format!("v{i}"), "index": 0})).unwrap();
-    }
-    let n = s.doc().unwrap().history.undo.len();
-    assert!((1..=8).contains(&n), "{n} steps of 1 MB notes kept under an 8 MB budget");
-}
-
 #[test]
 fn picture_styles_replace_each_other_in_one_step() {
     const PNG: &[u8] = &[