Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

fix(extensions): manifest id is not validated and is used as a path with recursive delete (path traversal)

Closed
  • Is something wrong?
#1,560 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
dart, flutter
Domain
desktop, security

Research direction

Read lib/core/extensions/models/extension_manifest.dart and the install paths in lib/core/extensions/local_extension_installer.dart; then inspect HttpMarketplaceRepository.install and uninstall for the corresponding path checks. Add the manifest ID validation and containment checks described in the issue, including the listed invalid IDs. Done means both installer paths reject traversal and the unit tests cover those IDs.

Written by the indexing model from the issue text.

Description

bug core marketplace P1 stability

Problem

ExtensionManifest.fromJson reads the id as json['id'] as String with no validation (lib/core/extensions/models/extension_manifest.dart:114). The id is then used as a path segment:

  • LocalExtensionInstaller.installFromArchive: Directory(p.join(root.path, manifest.id)), and if it exists, extDir.delete(recursive: true) (lib/core/extensions/local_extension_installer.dart:123-128).
  • HttpMarketplaceRepository.install and uninstall(extensionId): p.join(dir.path, manifest.id) / p.join(dir.path, extensionId), delete(recursive: true) in uninstall.

A sideloaded .qext with "id": "../../some/dir" makes the installer recursively delete a directory outside the extensions folder (and write the extracted files there). isArchiveEntryNameSafe only checks entry names inside the archive, not the manifest id.

Expected

  • Validate the id in ExtensionManifest.fromJson (e.g. ^[A-Za-z0-9][A-Za-z0-9._-]*$, no separators, no ..) and reject the manifest otherwise.
  • After p.join, check isArchiveExtractPathWithinRoot(root, extDir.path) before delete / create, in both installers and in uninstall.
  • Unit tests: ids ../x, a/b, ..\x, absolute path, empty.
Dominant language
Dart
Stars
23
Forks
1
Avg merge
49m
Merged PRs (30d)
496

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from QueryaHub/Querya-Desktop

All issues in QueryaHub/Querya-Desktop

Similar issues

More Dart issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.