From 94b5a114394a9c16f6e86148c7115e3be132fbc8 Mon Sep 17 00:00:00 2001 From: fwcd Date: Fri, 22 Dec 2023 03:11:05 +0100 Subject: [PATCH] Sandbox: Keep security tokens alive in canAccess methods This fixes a regression introduced in 5111af72d8d8e11b69391898d5d089d8a3c5e441 and the corresponding issues (#11552 and #12137). To prevent this from happening again, 8c6154ebe0ecb5a2b5e1778440f97b93eac7eac4 marks `openSecurityToken` as `[[nodiscard]]`. --- src/util/sandbox.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/util/sandbox.cpp b/src/util/sandbox.cpp index a14a4f9a34d..1596c119c18 100644 --- a/src/util/sandbox.cpp +++ b/src/util/sandbox.cpp @@ -75,13 +75,17 @@ bool Sandbox::canAccess(mixxx::FileInfo* pFileInfo) { VERIFY_OR_DEBUG_ASSERT(pFileInfo) { return false; } - openSecurityToken(pFileInfo, true); + // NOTE: The token must be assigned to a variable, otherwise it will be + // invalidated immediately (causing `isReadable` to fail). + auto token = openSecurityToken(pFileInfo, true); return pFileInfo->isReadable(); } //static bool Sandbox::canAccessDir(const QDir& dir) { - openSecurityTokenForDir(dir, true); + // NOTE: The token must be assigned to a variable, otherwise it will be + // invalidated immediately (causing `isReadable` to fail). + auto token = openSecurityTokenForDir(dir, true); return QFileInfo(dir.canonicalPath()).isReadable(); }