Repository navigation
SVG Interactivity: replies name JavaScript files outside the read roots by file name - #7205
Merged
bflatastic merged 1 commit intoNov 13, 2026
Conversation
…ts by file name With automation read roots in force, svgInteractivity.info and the files reply of addFile and removeFile returned every linked JavaScript file as stored, including paths outside the roots. They now name such a file by its file name alone, as document.json does; a file inside the roots and a URL are named as they are, and the document keeps every path. removeFile also unlinks a file outside the roots by that file name. When the name fits more than one linked file, it returns an error that names no stored path and unlinks nothing. addFile still treats only the same text as already linked. In a frame a request drives, the JavaScript Files dialog lists such a file by its file name while its selection keeps the file as linked, and ui.inspect gives the selected file the same way. The person's frames show full paths.
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 1 minute. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
vimalcvs
approved these changes
Nov 13, 2026
Member
|
Merged, thanks @dotCooCoo! It passed its CI checks. |
4 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
#6973 made
document.jsonname a linked JavaScript file outside a confined client's read roots by its file name alone.svgInteractivity.infoand thefilesreply ofsvgInteractivity.addFileandremoveFilestill returned every linked file as stored, so a confined client could read the full path of a file the person or an earlier, less confined request had linked. These replies now follow the same rule. The rules below are VectorCraft's own; no help page covers them.info,addFileandremoveFile(crates/engine/src/cmd/interactivity.rs) name a linked file outside the read roots by its file name alone, in the stored order. A relative path is taken from the document's folder. A file inside the roots and a URL are named as they are. The document keeps every path. The ruledocument.jsonused forsvg_scriptsis now shared aslinks::script_hiddenandlinks::shown_script(crates/engine/src/cmd/links.rs).removeFilealso unlinks a file outside the roots by the file name a reply gives it. When the name fits more than one linked file (two such files, or such a file and a file linked as that name), it returns"<name>" names more than one linked JavaScript fileand unlinks nothing. Neither error names a stored path.addFilestill treats a file as already linked only when the same text is linked, so adding a name that matches a hidden file's shown name links a new file.crates/ui-egui/src/dialogs/javascript_files.rs) lists such a file by its file name. Each row keeps the file as linked, so a click selects that file and Remove sends it. A name that fits several rows selects none of them.ui.inspect(crates/ui-egui/src/control.rs) gives the dialog's selected file the same way. The person's frames show full paths, as before.docs/mcp.md(the read-roots list and SVG interactivity) and one line indocs/target-app-parity.mddescribe this.Without read roots nothing changes. With read roots, the three replies no longer return paths outside them, and
removeFileaccepts the shown file name in addition to the stored text.This pull request covers the three
svgInteractivityreplies, the JavaScript Files dialog's list and selection, and the selected file inui.inspect. SVG export anddocument.serializewithformat: "svg"still write the stored paths, andui.inspectstill gives the dialog's typedfilefield as typed.How it was tested
New tests, each failing without the change:
javascript_file_replies_hide_paths_outside_read_roots(crates/engine/src/tests/interactivity.rs):info,addFileandremoveFilename an outside file and a relative path that resolves outside the roots by their file names, and keep an inside file and a URL as they are. A caller with only write roots gets file names; a caller whose read roots hold the files, and a caller without roots, get the full paths. The document keeps the stored paths.hidden_javascript_file_can_be_removed_by_unique_shown_name:removeFilewith the shown name unlinks the hidden file in one undo step.ambiguous_hidden_javascript_file_name_is_refused_without_edit: a name shared by two hidden files, or by a hidden file and a file linked as that name, is refused with an error that names no stored path, and nothing is unlinked.adding_a_shown_name_does_not_deduplicate_a_different_hidden_path:addFilewith a hidden file's shown name links a second file, within the 64-file limit.automation_javascript_files_dialog_hides_outside_root_paths(crates/ui-egui/src/dialogs/javascript_files.rs): in a confined frame the dialog lists the file name, its rows keep the linked file, and a name two rows share selects neither.ui_inspect_hides_a_selected_javascript_file_outside_the_read_root(crates/ui-egui/src/tests/automation.rs):ui.inspectgives the selected file by its file name.Focused checks on the final tree, on Linux. The branch is one commit on
mainat60fd4bd644and merges cleanly with it.cargo fmt --all -- --checkcargo check --workspace --testscargo clippy -p vectorcraft-engine --all-targets -- -D warningsandcargo clippy -p vectorcraft-ui-egui --all-targets -- -D warningscargo test -p vectorcraft-engine --libfiltered totests::interactivityanddocument_replies_leave_out_paths_outside_the_read_roots: 11 passed, 0 failed.cargo test -p vectorcraft-ui-egui --libfiltered to the JavaScript Files dialog tests and the newui.inspecttest: 4 passed, 0 failed.cargo xtask brands,cargo xtask layers(30 crates) andcargo xtask assets(337 files).cargo xtask ciruns in this pull request's CI.Checklist
cargo xtask cipasses (fmt, clippy, tests, assets, brands, layers, wasm).unwrap(),expect(),panic!,unreachable!,todo!orunimplemented!outside tests, and no unchecked indexing on data from files, parameters ormessages. Errors are returned as
Resultand shown to the user(why and how).
ASSETS.md.