# fix\(desktop\): reject crafted profile directories from Local State · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/commit/96a6de86c234b04831b8022c09d19f39c8db6a58)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

Requested revision: 96a6de86c234b04831b8022c09d19f39c8db6a58

Requested commit: 96a6de86c234b04831b8022c09d19f39c8db6a58

Commit: 96a6de86c234b04831b8022c09d19f39c8db6a58

Tree: 9e4d44df92fe25250d1d8da1a968cbddfae2771b

Author: Julius Marminge

Committer: Julius Marminge

## Message

```
fix(desktop): reject crafted profile directories from Local State

`info_cache` keys are directory names from the browser's own metadata file,
which anything running as the user can write. A key like `../../../../secrets`
was returned as a profile and handed to `cookieDatabasePath`, so the import
would read a database outside the browser's user-data directory — the same
escape the IPC-side guard closes, reached through the other door.

Only a single plain path segment is accepted now.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

```

## Parents

- [bec81f9643d420db5741d29a8a343d3811a88c87](https://git.cafe/pingdotgg/t3code/commit/bec81f9643d420db5741d29a8a343d3811a88c87?format=markdown)

[Source at this commit](https://git.cafe/pingdotgg/t3code/tree/96a6de86c234b04831b8022c09d19f39c8db6a58?format=markdown)