9285b19d6a
* Stop device names from being executed as Hyprland Lua Hyprland input-device and monitor names come from USB descriptors and hyprctl output, so they are attacker-influenceable, yet the toggle and monitor commands interpolated them straight into hyprctl eval and into generated Lua that Hyprland re-executes on every reload. The input-device toggle keys are bound with locked = true, so a malicious USB name reached Lua code execution from the lock screen; a persisted disable made it run on every start. This closes that class everywhere it appeared. - The touchpad/touchscreen disable is now the device name in a plain-text sidecar file, read back by a packaged Lua module on reload, never a generated Lua file. hyprctl eval Lua-quotes the name and control characters are rejected outright. - Dropped the shipped *-disabled.lua templates so nothing seeds a disabled state to /etc/skel, making the name file the single source of truth read from a hardcoded ~/.local/state to match the sibling tools. - The reload loader excludes those two legacy filenames, so a leftover generated *-disabled.lua on a not-yet-migrated install can never be sourced as code again; a migration then recovers the device name from it and deletes it, sanitizing installs that ran the vulnerable version. - All four monitor scripts (internal, mirror, clamshell, scaling) now validate an output name against a plain-connector-name pattern before writing it as Lua, closing the same latent pattern in the siblings. - paths.lua treats a set-but-empty XDG_STATE_HOME as unset, matching the bash side so state is never read from the filesystem root. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0144ZDt44vtxjyF8j9Y88NrM * Let a failing Lua assertion fail the test lua discards the status of a chunk read from stdin, so a blown assert printed its traceback and still exited 0: the surrounding `set -euo pipefail` never fired and the following `pass` printed `ok`. Every Lua block in these two files was unenforced, including the assertion that a quoted `hyprctl eval` cannot reach `os.execute` and the negative control that proves the test can detect the injection at all. Passing the chunk as a script argument makes lua report the failure. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Re-apply a recovered input-device disable to the running session The package hook reloads Hyprland during `omarchy-update-system-pkgs`, before `omarchy-migrate` runs, and at that reload the generated Lua is already excluded while the name file does not exist yet — so a touchpad or touchscreen the user had switched off comes back on, and stays on until their next login. Reload once more once the name has been recovered, which is the same path a login already takes to read it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-Authored-By: Codex XHigh <codex@openai.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Omarchybot <omabot@omarchy.org> Co-authored-by: Codex XHigh <codex@openai.com>
77 lines
1.9 KiB
Bash
Executable File
77 lines
1.9 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Enable, disable, or toggle a Hyprland input device
|
|
# omarchy:args=<touchpad|touchscreen> [on|off|toggle]
|
|
# omarchy:hidden=true
|
|
|
|
KIND="${1:-}"
|
|
ACTION="${2:-toggle}"
|
|
|
|
usage() {
|
|
echo "Usage: omarchy-toggle-input-device <touchpad|touchscreen> [on|off|toggle]" >&2
|
|
}
|
|
|
|
case "$KIND" in
|
|
touchpad) LABEL="Touchpad" ICON="touchpad" ;;
|
|
touchscreen) LABEL="Touchscreen" ICON="touch" ;;
|
|
*)
|
|
usage
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
# The persisted disable is the device name stored as plain data; on every
|
|
# reload default/hypr/disabled-input-device.lua reads it back and disables the
|
|
# device. Names come from USB descriptors and must not be interpolated into
|
|
# shell or Lua. The path is hardcoded to ~/.local/state like the sibling
|
|
# toggle tools, so it keeps working when XDG_STATE_HOME diverges.
|
|
NAME_FILE="$HOME/.local/state/omarchy/toggles/hypr/$KIND-disabled-name"
|
|
|
|
device="$("omarchy-hw-$KIND")"
|
|
|
|
require_device() {
|
|
if [[ -z $device ]]; then
|
|
echo "No $KIND device found" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ $device == *[[:cntrl:]]* ]]; then
|
|
echo "Invalid $KIND device name" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
apply_device() {
|
|
local enabled=$1
|
|
local quoted=${device//\\/\\\\}
|
|
quoted=${quoted//\"/\\\"}
|
|
hyprctl eval "hl.device({ name = \"$quoted\", enabled = $enabled })" >/dev/null
|
|
}
|
|
|
|
enable() {
|
|
# Clear the persisted state before requiring a usable device, so a device
|
|
# that stops reporting a valid name can never wedge the disable in place.
|
|
rm -f "$NAME_FILE"
|
|
require_device
|
|
apply_device true
|
|
omarchy-osd -i "$ICON" -m "$LABEL enabled"
|
|
}
|
|
|
|
disable() {
|
|
require_device
|
|
apply_device false
|
|
mkdir -p "$(dirname "$NAME_FILE")"
|
|
printf '%s\n' "$device" >"$NAME_FILE"
|
|
omarchy-osd -i "$ICON" -m "$LABEL disabled"
|
|
}
|
|
|
|
case "$ACTION" in
|
|
on) enable ;;
|
|
off) disable ;;
|
|
toggle) if [[ -f $NAME_FILE ]]; then enable; else disable; fi ;;
|
|
*)
|
|
usage
|
|
exit 1
|
|
;;
|
|
esac
|