Skip to content

Commit 2d33d2f

Browse files
authored
Add warning from upstream about TinyFD
1 parent af5498d commit 2d33d2f

File tree

1 file changed

+6
-0
lines changed
  • modules/ui/src/main/java/org/polyfrost/oneconfig/api/ui/v1/api

1 file changed

+6
-0
lines changed

modules/ui/src/main/java/org/polyfrost/oneconfig/api/ui/v1/api/TinyFdApi.java

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,12 @@
3232

3333
import java.nio.file.Path;
3434

35+
/**
36+
* API for TinyFD, a cross-platform file selection dialog.
37+
* <p>
38+
* On Linux, TinyFD "allows shell metacharacters in titles, messages, and other input data," meaning that it is vulnerable to command injection.
39+
* **Treat all user input as untrusted and sanitize it before passing it to TinyFD.**
40+
*/
3541
@SuppressWarnings("unused")
3642
public interface TinyFdApi {
3743
String QUESTION_ICON = "question";

0 commit comments

Comments
 (0)