Files
omarchy/bin
Adrian RangelandClaude Opus 5 2e989e35e5 [Security] Stop USB device names from being executed as Hyprland Lua (backport of #8129)
Backport of the input-device name fix (PR #8129 by @acrogenesis, merged to
quattro as 9285b19d) onto the v4-0-1 release branch.

Hyprland input-device and monitor names come from USB descriptors and hyprctl
output, so they are attacker-influenceable, yet the toggle and monitor commands
interpolated them straight into hyprctl eval and into generated Lua that
Hyprland re-executes on every reload. XF86TouchpadToggle is bound with
locked = true, so a malicious USB name reached Lua execution from the lock
screen as the logged-in user, and a persisted disable made it run on every
start. Publicly reported by Jorrit Jongma / Chainfire.

The disable is no longer executable Lua anywhere. The device name is stored as
plain-text data in a *-disabled-name sidecar and read back by a packaged module,
default/hypr/disabled-input-device.lua, on every reload; the live hyprctl eval
Lua-quotes the name and rejects control characters outright. The reload loader
excludes the two legacy filenames, so a leftover generated *-disabled.lua on a
not-yet-migrated install can never be sourced as code again, and a migration
recovers the device name from it and deletes it, sanitizing installs that ran
the vulnerable version. All four monitor scripts validate an output name against
a plain-connector-name pattern before writing it as Lua, closing the same latent
pattern in the siblings, and paths.lua treats a set-but-empty XDG_STATE_HOME as
unset to match the bash side.

Clean cherry-pick: all fourteen files are byte-identical to quattro, so merging
v4-0-1 into quattro resolves without a conflict. This branch ships no leftover
*-disabled.lua template of its own -- the tracked "disabled" files are the same
two quattro has -- so the migration is the only path that has to sanitize
anything here.

test/shell passes: 192 files, including the three this adds. The toggle suite's
public-PoC case passes here, as do the monitor scripts' accept/reject cases and
the XDG path cases. test/cli passes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
2026-08-25 11:07:35 +02:00
..
2026-05-21 15:45:36 +02:00
2026-08-11 13:56:09 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-21 19:30:30 +02:00
2026-05-01 17:40:22 +02:00
2026-05-06 12:58:55 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-21 19:30:30 +02:00
2026-05-25 18:19:06 +02:00
2026-05-01 17:40:22 +02:00
2026-05-20 14:09:09 +02:00
2026-05-20 14:12:06 +02:00
2026-05-19 20:54:20 +02:00
2026-05-19 20:54:20 +02:00
2026-05-14 12:02:53 +02:00
2026-05-14 12:02:53 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-06-04 18:37:32 -04:00
2026-05-01 17:40:22 +02:00
2026-05-04 11:18:25 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-05 14:22:03 +02:00
2026-08-08 02:31:23 -07:00
2026-05-01 17:40:22 +02:00
2026-06-04 11:14:04 +02:00
2026-06-04 11:14:04 +02:00
2026-05-01 17:40:22 +02:00
2026-06-04 18:37:32 -04:00
2026-06-28 20:46:23 -04:00
2026-05-08 20:48:36 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00