From 0ff6bd2267267db71853baa9aa5a9b3c6002be51 Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 9 Oct 2026 12:40:26 +0200 Subject: [PATCH] Issue 346: user-dirs.dirs is trusted again for now (mesh-catalog #158), the stop-gap before the fix --- .../00-report.md | 3 ++- .../01-diagnosis.md | 6 ++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/04-ISSUES/346-a-setting-a-verb-may-set-is-pasted-raw-into-its-file/00-report.md b/04-ISSUES/346-a-setting-a-verb-may-set-is-pasted-raw-into-its-file/00-report.md index 6ca4ff6f..d98e62f0 100644 --- a/04-ISSUES/346-a-setting-a-verb-may-set-is-pasted-raw-into-its-file/00-report.md +++ b/04-ISSUES/346-a-setting-a-verb-may-set-is-pasted-raw-into-its-file/00-report.md @@ -48,8 +48,9 @@ the format has no way to end a statement or a quoted string within a line. - Any caller of the `settings` verb (an agent session, a tool) can rewrite a desktop program's configuration beyond the key it was given, as the operator's account. -- Two files are marked untrusted on main today. The survey in [01-diagnosis.md](01-diagnosis.md) judges +- Two files were marked untrusted on main. The survey in [01-diagnosis.md](01-diagnosis.md) judges both: the `xdg` module's `user-dirs.dirs` is open to the same injection, `dunst`'s `dunstrc` is not. + `user-dirs.dirs` is made trusted again for now (mesh-catalog #158). ## What is asked diff --git a/04-ISSUES/346-a-setting-a-verb-may-set-is-pasted-raw-into-its-file/01-diagnosis.md b/04-ISSUES/346-a-setting-a-verb-may-set-is-pasted-raw-into-its-file/01-diagnosis.md index 92fb0c17..8cd64cd2 100644 --- a/04-ISSUES/346-a-setting-a-verb-may-set-is-pasted-raw-into-its-file/01-diagnosis.md +++ b/04-ISSUES/346-a-setting-a-verb-may-set-is-pasted-raw-into-its-file/01-diagnosis.md @@ -27,8 +27,10 @@ a node. Mergeable JSON files ("any mergeable file takes any key", issue 340) are not pasted: values are merged as JSON and encoded by the encoder. They are outside this defect. -**Recommendation for now:** mark `user-dirs.dirs` trusted again (terminal-only) in a catalogue change, as -`picom.conf` was kept in mesh-catalog #157. `dunstrc` may stay as it is. +**Done for now (2026-10-09):** `user-dirs.dirs` is marked trusted again (terminal-only) in mesh-catalog +#158, as `picom.conf` was kept in mesh-catalog #157. A test in each module fails if its file carries a +trusted marking, naming this issue. `dunstrc` stays as it is. This is the stop-gap, not the fix: the +fix below still stands. ## The fix proposed