From f27656b9109af338c64d6a9a031b14f3db1ecbbf Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Fri, 23 Oct 2026 09:57:10 -0400 Subject: [PATCH] fix: restrict droplet shim permissions and annotate test range (SonarCloud) (#8870) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The generated droplet shim only needs to run as its creator, so 0700 keeps other local accounts from reading the CLI path it invokes. The reversed range in the arrow-key test is the case under test, not an accident. 🤖 Generated with Codebuff Co-authored-by: Codebuff --- crates/engine/src/automate_cmds.rs | 4 +++- crates/ui-egui/src/widgets.rs | 3 ++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/crates/engine/src/automate_cmds.rs b/crates/engine/src/automate_cmds.rs index 2256a76cda..800ff954e0 100644 --- a/crates/engine/src/automate_cmds.rs +++ b/crates/engine/src/automate_cmds.rs @@ -358,7 +358,9 @@ fn write_shim(droplet: &str) -> Result { #[cfg(unix)] { use std::os::unix::fs::PermissionsExt; - let _ = std::fs::set_permissions(&shim, std::fs::Permissions::from_mode(0o755)); + // The shim only has to run as the user who created it; 0o755 would also let every other + // local account read and execute it. + let _ = std::fs::set_permissions(&shim, std::fs::Permissions::from_mode(0o700)); } Ok(shim) } diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs index d7ab90b2e9..223d0cfa8e 100644 --- a/crates/ui-egui/src/widgets.rs +++ b/crates/ui-egui/src/widgets.rs @@ -2367,7 +2367,8 @@ mod tests { #[test] fn arrow_keys_on_a_field_with_a_reversed_range_do_not_panic() { - let mut h = focused(5.0, 10.0..=0.0); + // The empty range is the case under test — arrow keys must not panic on it. + let mut h = focused(5.0, 10.0..=0.0); // NOSONAR let _ = press(&mut h, Modifiers::NONE, Key::ArrowUp); let mut h = focused(5.0, f32::NAN..=10.0); let _ = press(&mut h, Modifiers::NONE, Key::ArrowDown);