Function assertWritablePath

src/main/electron.js:2940–3014

(p)

// (defeating symlink traversal) and accepts only paths in blessedPaths or
// their draft/backup siblings.
async function assertWritablePath(p)
{
	if (typeof p !== 'string' || !p || p.includes('\0'))
	{
		throw new Error('path not authorised');
	}

	const resolved = path.resolve(p);
	let realpath;

	try
	{
		realpath = await fsProm.realpath(resolved);
	}
	catch (e)
	{
		// File doesn't exist yet (e.g. Save As to a new file). Canonicalise
		// the parent directory so symlinks in the directory chain are still
		// resolved.
		try
		{
			const parentReal = await fsProm.realpath(path.dirname(resolved));
			realpath = path.join(parentReal, path.basename(resolved));
		}
		catch (e2)
		{
			// Neither the file nor its parent could be realpath-canonicalised.
			// This happens on filesystems whose driver doesn't support the
			// underlying call (e.g. WinFSP "local" / Cryptomator, some FUSE
			// mounts), not just on missing paths. realpath is a defence-in-depth
			// measure against symlink traversal; when it's simply unavailable we
			// must not deny an otherwise-blessed write, so fall back to the
			// lexically-resolved path. blessedPaths is still consulted below, so
			// only paths the user authorised through trusted UI are accepted.
			realpath = resolved;
		}
	}

	if (realpath.startsWith(appBaseDir))
	{
		throw new Error('path not authorised');
	}

	// Block writes anywhere inside userData (settings store, plugins, Local
	// Storage). installPlugin has its own write-into-userData flow and is
	// out of scope here; it does not go through assertWritablePath.
	let userDataDir;

	try
	{
		userDataDir = path.resolve(app.getPath('userData'));
	}
	catch (e)
	{
		userDataDir = null;
	}

	if (userDataDir && (realpath === userDataDir ||