mirror of
https://github.com/electron/electron.git
synced 2026-10-28 11:44:46 +08:00
0240841b24
* fix: carry upstream macOS firmlink blocklist fix into exposed FSA blocklist
Chromium 156.0.8078.3 already contains upstream 64c8e2a1ceda ("[FSA] Block
macOS firmlink alias paths to sensitive directories"), but
refactor_expose_file_system_access_blocklist.patch re-adds
NormalizeFilePath()/GenerateBlockPaths() as static members in the header
without the new pieces, so Electron's copy of the blocklist does not carry
the fix.
Update the patch's header copy to match upstream: add the
MaybeStripMacDataVolumePrefix() and NormalizeFilePathForBlocklist() static
helpers, the /System/Volumes kBlockAllChildren rule, and normalize
generated rules through NormalizeFilePathForBlocklist().
Refs https://chromium-review.googlesource.com/c/chromium/src/+/8410087 (upstream commit 64c8e2a1cedafdbcc750abc423ad9b389537c223)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx
* fix: fold macOS Data volume firmlink paths in file system access blocklist checks
Switches Electron's copy of ShouldBlockAccessToPath() to the
NormalizeFilePathForBlocklist() helper (from upstream 64c8e2a1ceda, exposed
in the header by the companion refactor_expose_file_system_access_blocklist
patch update), so paths spelled via /System/Volumes/Data are matched
against the root-namespace blocklist rules the same way Chrome does.
Refs https://chromium-review.googlesource.com/c/chromium/src/+/8410087 (upstream commit 64c8e2a1cedafdbcc750abc423ad9b389537c223)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx
* test: cover /System/Volumes/Data alias paths in FSA blocklist
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx
* refactor: compile upstream FSA blocklist helpers instead of copying them
refactor_expose_file_system_access_blocklist.patch used to hand-copy
upstream's NormalizeFilePath(), NormalizeFilePathForBlocklist() and
GenerateBlockPaths() into the header as inline static members. Since #53634
dropped the .cc hunks, upstream edits to the originals no longer conflict on
roll, so the copy goes stale silently (this is how the firmlink fix
64c8e2a1ceda was lost on the M156 roll; main's copy also still keeps the
.git/hooks rule Windows-only, while upstream applies it on all platforms).
Instead, declare NormalizeFilePathForBlocklist() and GenerateBlockPaths() as
static members in the header and move upstream's definitions verbatim out of
chrome_file_system_access_permission_context.cc into a new
chrome_file_system_access_blocklist.cc, which Electron now compiles as part
of //electron/chromium_src:chrome. Upstream changes to the blocklist now
conflict loudly on the removal hunk instead of being dropped.
Electron's call sites are unchanged.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx
* chore: update patches
Regenerate the index line for chrome_file_system_access_permission_context.cc
in refactor_expose_file_system_access_blocklist.patch so the patch round-trips
through `e patches chromium` against 156.0.8078.3 (fixes "needs update" in the
checkout jobs).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx
* chore: update patches
Regenerate the index line for chrome_file_system_access_permission_context.cc
in refactor_expose_file_system_access_blocklist.patch against
157.0.8085.0 after merging main (Chromium roll #54590), matching the
update-patches.patch artifact from the failed apply-patches check.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx
* test: resolve home dir symlinks and cover /System/Volumes rule in FSA firmlink spec
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx
* chore: update patches
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx
* chore: update patches
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx
* chore: update patches
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx
* chore: update patches
Rebase refactor_expose_file_system_access_blocklist.patch onto 158.0.8118.0
and carry the upstream kBlockPaths additions from that version into
chrome_file_system_access_blocklist.cc.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx
* chore: update patches
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>