From a588eb5983902c32545e45b273e1394e7a57da64 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 9 Oct 2026 12:40:04 +0200
Subject: [PATCH] xdg: keep the folders file trusted, so only the terminal sets
 the folders (hq issue 346)

user-dirs.dirs is shell assignments meant to be sourced by a shell, and a setting is pasted into it as
it is, so a folder of $HOME/x"; <command>; X=" set through the verb would add a command of the
caller's. With the file trusted again, the three folders are set at the controller's terminal alone
until settings are typed and quoted at render.
---
 modules/xdg/README.md                      |  5 +++++
 modules/xdg/cmd/xdg-tools/manifest_test.go | 18 ++++++++++++++++++
 modules/xdg/module.json                    |  1 -
 3 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/modules/xdg/README.md b/modules/xdg/README.md
index 81b018b6..ee3d9663 100644
--- a/modules/xdg/README.md
+++ b/modules/xdg/README.md
@@ -47,6 +47,11 @@ default, so the mesh's layer is set before the first assignment (as `power`'s ar
 one file: the module has no merged file and no contribution, so issue 168 cannot carry them anywhere
 else.
 
+**They are set at the controller's terminal alone** (the file is trusted, unmarked; issue 339). A value is
+pasted into the file as it is, and the format is shell assignments meant to be sourced by a shell, so a
+value of `$HOME/x"; <command>; X="` would add a command of whoever set it (hq issue 346). Until settings
+are typed and quoted when written, no verb may set them.
+
 **Why `xdg-user-dirs-update` is disabled.** It runs at every login, from its XDG autostart entry, which
 `dex` starts. Measured on xdg-user-dirs 0.20 against a copy of the folders:
 
diff --git a/modules/xdg/cmd/xdg-tools/manifest_test.go b/modules/xdg/cmd/xdg-tools/manifest_test.go
index 16ca3741..d05ba07a 100644
--- a/modules/xdg/cmd/xdg-tools/manifest_test.go
+++ b/modules/xdg/cmd/xdg-tools/manifest_test.go
@@ -194,3 +194,21 @@ func TestTheToolsAgreeWithTheManifest(t *testing.T) {
 		}
 	}
 }
+
+// The folders file stays trusted (unmarked), so its three settings are set at the controller's terminal
+// alone. A value is pasted into it as it is, and the format is shell assignments defined to be sourced
+// by a shell: `$HOME/x"; <command>; X="` would add a command of the caller's (hq issue 346). Until
+// settings are typed and quoted at render, no verb may set them.
+func TestTheFoldersFileStaysTrustedUntilSettingsAreQuoted(t *testing.T) {
+	m, _ := readManifest(t)
+	for _, r := range m.Resources {
+		if r["id"] != "user-dirs" {
+			continue
+		}
+		if _, marked := r["trusted"]; marked {
+			t.Fatal("user-dirs.dirs carries a trusted marking: its settings are the terminal's alone (hq issue 346)")
+		}
+		return
+	}
+	t.Fatal("no user-dirs resource")
+}
diff --git a/modules/xdg/module.json b/modules/xdg/module.json
index 3bf16308..135c1283 100644
--- a/modules/xdg/module.json
+++ b/modules/xdg/module.json
@@ -24,7 +24,6 @@
     },
     {
       "id": "user-dirs",
-      "trusted": false,
       "type": "file",
       "path": "${machine:account-home}/.config/user-dirs.dirs",
       "owner": "${machine:account}",