Skip to content

Adds a warning when opening an SSHFS remote file lead to local edition#56

Merged
HorlogeSkynet merged 2 commits intomasterfrom
sec/symlink_escape
Dec 15, 2025
Merged

Adds a warning when opening an SSHFS remote file lead to local edition#56
HorlogeSkynet merged 2 commits intomasterfrom
sec/symlink_escape

Conversation

@HorlogeSkynet
Copy link
Copy Markdown
Owner

see #55


@neogeographica so this is a pretty naive approach dealing with SSHFS remote files resolving locally.
A warning dialog is displayed, and the file will be closed if one clicks on the Cancel button. This can be considered as a "guardrail" for users running SSHubl with follow_symlinks disabled and a remote fs containing absolute/relative symlinks leading to outside of remote mounted folder.

@HorlogeSkynet HorlogeSkynet requested a review from d3vyce October 28, 2025 22:28
@HorlogeSkynet HorlogeSkynet self-assigned this Oct 28, 2025
@HorlogeSkynet HorlogeSkynet added the security A security concern is being addressed label Oct 28, 2025
@neogeographica
Copy link
Copy Markdown
Contributor

neogeographica commented Nov 3, 2025

There's an oddity if preview_on_click is true (the default).

If I do just click once on a file so that it opens as a preview:

  • The file opens as a preview.
  • The dialog implemented by this PR appears.
  • If I click Cancel, the dialog and the preview both close.
  • Alternately if I click Yes, the dialog goes away and the preview stays.
  • I can then choose to double-click on the file if I want to actually open it as a non-preview.

However, in cases where I'm really just intending to open a file, I never just single click on it. Instead I immediately double-click on it. If I double-click:

  • The file opens as a preview.
  • The dialog implemented by this PR appears.
  • My second click of the double-click raises the main ST window, so that the dialog is hidden.
  • The file remains as a preview instead of being opened, and the main ST window will not respond to clicks.

When I get into that latter state, I have to hunt up the dialog window and bring it to the front (after recognizing what the problem actually is), to click either Cancel or Yes there. A little confusing/nonideal, although I'm not sure how to improve it.

@HorlogeSkynet
Copy link
Copy Markdown
Owner Author

HorlogeSkynet commented Nov 3, 2025

Many thanks for your feedback Joel 🙏

So I tried playing with Sheet.is_semi_transient and Sheet.is_transient to detect these cases, but it didn't work as I hoped. Even if it actually caught opening some file "previews", it didn't hook views going "read-write" afterwards.

I guess the behavior also depends on the Window Manager (e.g. in my case, when ST dialog pops up, it always stays above the other ST windows, so I haven't to hunt it).

I also tried to leverage Window.bring_to_front API to force showing the pop-up, but it seems we cannot interact with dialog windows.

As sshfs_mount_follow_symlinks option will usually stay enabled for most of people, do you think this edge case should really be addressed ? Or the "guardrail as-is" is best than nothing at all ?

Thanks ! Bye 👋

@HorlogeSkynet HorlogeSkynet marked this pull request as ready for review November 10, 2025 19:39
d3vyce
d3vyce previously approved these changes Nov 13, 2025
@HorlogeSkynet
Copy link
Copy Markdown
Owner Author

Hello @neogeographica, any recent thoughts on the matter before we actually merge this ? Thanks 🙏

@neogeographica
Copy link
Copy Markdown
Contributor

Since it has some potentially bad/confusing behaviors with the default setting for preview_on_click, personally I guess I would lean toward not doing it.

@HorlogeSkynet
Copy link
Copy Markdown
Owner Author

HorlogeSkynet commented Nov 15, 2025

Hello @neogeographica, and thanks for your inputs on this.
I've just pushed 561627c, which is a new implementation leveraging ST HTML popup mechanism (instead of window dialog).
It also fixes detection of paths resolving to SSHubl internal mounts folder, but outside of mount points (i.e. ~/.cache/sublime-text/Cache/SSHubl/mounts/ -> here <- / -> or here <-).

Could you tell us what do you think about this approach when you have a chance to give it a try ?
Thanks again, bye 👋


EDIT : tests are failing due to UnitTesting upstream change, please see SublimeText/UnitTesting#277 fixed by dab5922

@HorlogeSkynet HorlogeSkynet linked an issue Nov 15, 2025 that may be closed by this pull request
@neogeographica
Copy link
Copy Markdown
Contributor

Looks like a better approach yeah.

Ideally it could be possible to dismiss the warning for the duration of a session? In case you're intentionally working with a lot of such files. But that could just be bikeshedding at this point.

@HorlogeSkynet HorlogeSkynet requested a review from d3vyce December 10, 2025 16:43
@HorlogeSkynet
Copy link
Copy Markdown
Owner Author

Looks like a better approach yeah.

Thanks for your feedback 🙏

Ideally it could be possible to dismiss the warning for the duration of a session? In case you're intentionally working with a lot of such files. But that could just be bikeshedding at this point.

I'd vote against that at this time :

  • I don't want to "bloat" sessions data
  • Feature is disabled by default and very few people will be affected
  • One usually don't frequently close files (?)
  • I tend to avoid stateful security checks

We'll merge this soon, and publish a new SSHubl release.

Thanks, bye 👋

@HorlogeSkynet HorlogeSkynet merged commit 68658fb into master Dec 15, 2025
9 checks passed
@HorlogeSkynet HorlogeSkynet deleted the sec/symlink_escape branch December 15, 2025 15:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security A security concern is being addressed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

multiple situations blocking unmount

3 participants