Sorcery Desktop handles external URLs (srcuri://) that can open files in local editors. This document describes the security measures in place.
Primary threats:
- Malicious URLs attempting to execute arbitrary code
- Path traversal attacks to access files outside workspaces
- Command injection through file paths
- NTLM credential leakage via UNC paths (Windows)
Trust boundaries:
- URLs arrive from external sources (browsers, chat apps, documentation)
- Settings file is user-controlled (local filesystem)
- Editor binaries are system-installed
All file paths are validated before being passed to editors:
| Pattern | Reason |
|---|---|
../ and ..\ |
Path traversal |
// |
Protocol injection |
Shell metacharacters: ; & | \ $ # ' " { } < >` |
Command injection |
UNC paths \\server\share |
NTLM credential leakage |
Binary extensions: .exe, .app, .dmg |
Executable files |
| Paths > 4096 characters | Buffer overflow prevention |
Mid-path ~ characters |
Expansion attacks |
| Pattern | Reason |
|---|---|
() parentheses |
Common in macOS folder names |
[] brackets |
Valid in most filesystems |
Leading ~ |
Standard home directory expansion |
@, %, +, = |
Safe special characters |
Editors are launched via Rust's Command API with arguments passed directly, never through a shell. This prevents command injection even if a malicious character bypasses validation.
| Reference Type | Validation |
|---|---|
| Branch names | Max 128 chars, no .., alphanumeric + /-_. |
| Tag names | Max 128 chars, no .., alphanumeric + /-_. |
| Commit SHAs | 7-64 hexadecimal characters only |
| Remote URLs | No .., no //, validated structure |
Reserved authorities (wks, rel, abs, ext) are case-insensitive and cannot be used as workspace names, preventing confusion attacks.
- Revisions are validated with
git rev-parse --verifybefore use - File content from revisions is limited to 10MB
- Output is validated as UTF-8
- Working tree operations require explicit user confirmation via dialogs
- Directory scanning is limited to 1000 entries
- Scan operations timeout after 5 seconds
- Only immediate children of the workspaces folder are scanned (no recursion)
- Dialog data comes from validated backend state
- User-provided data (workspace names, paths) originates from local settings file
- No external data is rendered without backend validation
If you discover a security vulnerability, please report it by emailing the maintainers directly rather than opening a public issue. We will acknowledge receipt within 48 hours and provide a detailed response within 7 days.