Refresh 2026 | Security, stability, and Wayland compatibility improvements - #407
Open
maifeeulasad wants to merge 28 commits into
Open
maifeeulasad wants to merge 28 commits into
maifeeulasad wants to merge 28 commits into
Conversation
maifeeulasad
commented
Sep 19, 2026
maifeeulasad
commented
- Hardened WebView, wallpaper handling, installation scripts, and filesystem permissions.
- Added validation against path traversal and unsafe wallpaper/configuration values.
- Improved startup stability and compatibility across Wayland/Linux environments.
- Migrated to WebKitGTK 4.1 with fallback support.
- Fixed wallpaper rendering and RGBA texture crashes.
- Added Wayland support documentation and SECURITY.md with the threat model/dependency surface.
- Cleaned up repository/build artifacts and ignored .DS_Store files.
web_page wallpapers load a URL taken verbatim from an untrusted wallpaper pack config, running persistently on the desktop with the user's rights. - Lock down WebKitSettings: disable file/universal access from file URLs, disable plugins/java, and stop writing console messages to stdout. - Restrict loadable URLs to http/https/file schemes and warn on http://. Refs #1 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The post-install script runs as root and previously used unquoted expansions, globbed /home/* directly, and ran `rm -rf` on paths built from those names. - Enable strict mode (set -euo pipefail) and quote all expansions. - Enumerate real users (UID >= 1000, existing home) from /etc/passwd instead of globbing /home/*. - Replace `rm -rf` of the legacy prop file with a guarded `rm -f` on a regular file; use install(1) for autostart with correct ownership. - Iterate wallpaper dirs with find -print0 (space/metachar safe) and parse config values without word-splitting. - Point CMake's install-time hook at the actual `postinst` file (was referencing a non-existent postinst.sh). Refs #2 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The daemon loads its binary, wallpapers, and icons from non-standard /System/... paths every session. Without explicit permissions a loose umask could leave them writable by non-owners, enabling local tampering (e.g. swapping a wallpaper config to abuse the web_page WebView). Set explicit PERMISSIONS / FILE_PERMISSIONS / DIRECTORY_PERMISSIONS on the /System/Applications and /System/Resources/Komorebi installs so files are never group- or world-writable. Refs #3 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
WallpaperName (from ~/.Komorebi.prop) and VideoFileName (from a pack's config) were concatenated into filesystem/URI paths without validation, allowing "../" traversal outside the wallpapers directory. Add isSafePathComponent() and validate both values, falling back to the default wallpaper / an empty video name when a component is unsafe. Refs #4 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Position, Alignment, and Asset AnimationMode were read as free strings from an untrusted pack config and fed to renderer switch statements. Add validatedChoice() and constrain each field to the values the code actually handles, falling back to a safe default (center / center / noanimation) with a warning otherwise. Refs #7 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Committed macOS .DS_Store files leak local filesystem metadata and add noise. Remove them from the index and ignore them going forward. Refs #6 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Wallpaper packs are untrusted input decoded by GdkPixbuf/GStreamer and, for web_page packs, rendered by WebKitGTK. Document the threat model, the CVE-prone dependency surface (keep patched, especially WebKitGTK), the reporting process, and the hardening already applied. Refs #5 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
[Security][Low] Remove committed .DS_Store files and gitignore them (#6)
[Security][High] Harden root postinst script (#2)
[Security][Medium] Pin non-world-writable permissions on /System install paths (#3)
[Security][Medium] Document threat model & dependency surface (SECURITY.md) (#5)
[Security][High] Harden web_page WebView & validate URL scheme (#1)
[Security][Medium] Reject path traversal in WallpaperName/VideoFileName (#4)
# Conflicts: # src/Utilities.vala
[Security][Low] Whitelist enum-like wallpaper config fields (#7)
libwebkit2gtk-4.0-dev was removed on modern distros (Ubuntu 22.04+/24.04). webkit2gtk-4.1 is the drop-in successor: same WebKit2/GTK3 API, built against libsoup3. - Detect webkit2gtk-4.1 via pkg-config and fall back to 4.0 on older systems, driving both the pkg check and the Vala --pkg name from one WEBKIT_PKG variable. - Debian dependency now accepts libwebkit2gtk-4.1-0 | libwebkit2gtk-4.0-37. - Update SECURITY.md dependency table. Fixes #15 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
[Build] Migrate webkit2gtk-4.0 -> 4.1 with fallback (#15)
Two startup bugs surfaced when running the built app:
1. isSafePathComponent rejected every name because `name.contains("\0")`
uses an empty (NUL-terminated) needle, so strstr always matches.
Drop the embedded-NUL check; keep the "/", "\", ".", ".." checks.
(regression from #4)
2. A desktop icon that fails to load aborted the whole process:
getIconFrom() could return null and Clutter.Image.set_data() (a
throwing call) was unguarded, so a null/invalid pixbuf triggered an
uncaught clutter-image-error and a g_object_ref_sink assertion.
- getIconFrom() now never returns null (blank fallback pixbuf).
- New Icon.setIcon() null-checks, wraps set_data in try/catch, and
uses the pixbuf's real dimensions instead of iconSize.
Fixes #17
Fixes #18
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Clutter.Image.set_data was called with Cogl.PixelFormat.RGB_888 for pixbufs without alpha. Many GPU drivers / GLES backends cannot create 24-bit textures and abort fatally with "Failed to create texture 2d due to size/format constraints" (uncatchable Cogl g_error) -> core dump. - Add Utilities.ensureRGBA(): returns a 32-bit RGBA pixbuf (add_alpha when needed). - Route all four set_data sites (Icon, wallpaper, two in AssetActor) through it and always use Cogl.PixelFormat.RGBA_8888. - Remove dead null-deref branch in AssetActor.setAsset() (!assetVisible did pixbuf = null then pixbuf.get_pixels()). Known upstream crash: christianloopp#362, christianloopp#354/christianloopp#240. Fixes #20 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
[Bug] Upload RGBA textures instead of RGB_888 — fixes Cogl texture crash (#20)
checkDesktopCompatible() inspected XDG_SESSION_DESKTOP (the desktop name,
e.g. "ubuntu"), which never contains "wayland", so Wayland sessions were
not detected: the X11-only app ran under Wayland and core-dumped in Cogl
("Failed to create texture 2d due to size/format constraints"). The old
line also NUL-dereferenced when the variable was unset.
- Detect Wayland via XDG_SESSION_TYPE (+ WAYLAND_DISPLAY fallback),
null-safe.
- Honour an explicit GDK_BACKEND=x11 override so users can try XWayland.
- Point the error message at the Xorg session / GDK_BACKEND=x11 workarounds.
Fixes #22
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
[Bug] Fix broken Wayland detection (crash on Wayland) (#22)
Co-authored-by: OpenCode/Big Pickle <noreply@opencode.ai>
Co-authored-by: OpenCode/Big Pickle <noreply@opencode.ai>
Co-authored-by: OpenCode/Big Pickle <noreply@opencode.ai>
Co-authored-by: OpenCode/Big Pickle <noreply@opencode.ai>
Wayland support
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.