Skip to content

HistoryService: path traversal sanitization and exception resilience #636

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheJoeFin merged 2 commits into from
Mar 10, 2026
Merged

HistoryService: path traversal sanitization and exception resilience #636

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
72088ed
Initial plan
Copilot Mar 10, 2026
3132696
fix: sanitize path traversal and add exception handling in HistorySer…
Copilot Mar 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 66 additions & 13 deletions Text-Grab/Services/HistoryService.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -374,26 +374,53 @@ public async Task<List<WordBorderInfo>> GetWordBorderInfosAsync(HistoryInfo hist

if (!string.IsNullOrWhiteSpace(history.WordBorderInfoFileName))
{
string historyBasePath = await FileUtilities.GetPathToHistory();
string wordBorderInfoPath = Path.Combine(historyBasePath, history.WordBorderInfoFileName);
// Sanitize the persisted file name to prevent path traversal outside the history directory
string sanitizedFileName = Path.GetFileName(history.WordBorderInfoFileName);

if (File.Exists(wordBorderInfoPath))
if (!string.IsNullOrWhiteSpace(sanitizedFileName)
&& string.Equals(Path.GetExtension(sanitizedFileName), ".json", StringComparison.OrdinalIgnoreCase))
{
await using FileStream wordBorderInfoStream = File.OpenRead(wordBorderInfoPath);
List<WordBorderInfo>? wordBorderInfos =
await JsonSerializer.DeserializeAsync<List<WordBorderInfo>>(wordBorderInfoStream, HistoryJsonOptions);

return wordBorderInfos ?? [];
try
{
string historyBasePath = await FileUtilities.GetPathToHistory();
string wordBorderInfoPath = Path.Combine(historyBasePath, sanitizedFileName);

if (File.Exists(wordBorderInfoPath))
{
await using FileStream wordBorderInfoStream = File.OpenRead(wordBorderInfoPath);
List<WordBorderInfo>? wordBorderInfos =
await JsonSerializer.DeserializeAsync<List<WordBorderInfo>>(wordBorderInfoStream, HistoryJsonOptions);

if (wordBorderInfos is not null)
return wordBorderInfos;
}
}
catch (IOException ex)
{
Debug.WriteLine($"Failed to read word border info file for history item '{history.ID}': {ex}");
}
catch (JsonException ex)
{
Debug.WriteLine($"Failed to deserialize word border info file for history item '{history.ID}': {ex}");
}
}
}

if (string.IsNullOrWhiteSpace(history.WordBorderInfoJson))
return [];

List<WordBorderInfo>? inlineWordBorderInfos =
JsonSerializer.Deserialize<List<WordBorderInfo>>(history.WordBorderInfoJson, HistoryJsonOptions);
try
{
List<WordBorderInfo>? inlineWordBorderInfos =
JsonSerializer.Deserialize<List<WordBorderInfo>>(history.WordBorderInfoJson, HistoryJsonOptions);

return inlineWordBorderInfos ?? [];
return inlineWordBorderInfos ?? [];
}
catch (JsonException ex)
{
Debug.WriteLine($"Failed to deserialize inline word border info for history item '{history.ID}': {ex}");
return [];
}
}

public void ReleaseLoadedHistories()
Expand Down Expand Up @@ -551,8 +578,21 @@ private static void DeleteHistoryFile(string? historyFileName)
string historyBasePath = GetHistoryPathBlocking();
string filePath = Path.Combine(historyBasePath, Path.GetFileName(historyFileName));

if (File.Exists(filePath))
if (!File.Exists(filePath))
return;

try
{
File.Delete(filePath);
}
catch (IOException ex)
{
Debug.WriteLine($"Failed to delete history file '{filePath}': {ex}");
}
catch (UnauthorizedAccessException ex)
{
Debug.WriteLine($"Access denied when deleting history file '{filePath}': {ex}");
}
}

private void DeleteUnusedWordBorderFiles(IEnumerable<HistoryInfo> historyItems)
Expand All @@ -574,7 +614,20 @@ private void DeleteUnusedWordBorderFiles(IEnumerable<HistoryInfo> historyItems)
string fileName = Path.GetFileName(wordBorderInfoFile);

if (!expectedFileNames.Contains(fileName))
File.Delete(wordBorderInfoFile);
{
try
{
File.Delete(wordBorderInfoFile);
}
catch (IOException ex)
{
Debug.WriteLine($"Failed to delete word border info file '{wordBorderInfoFile}': {ex}");
}
catch (UnauthorizedAccessException ex)
{
Debug.WriteLine($"Access denied when deleting word border info file '{wordBorderInfoFile}': {ex}");
}
}
}
}

Expand Down