Harden preset deletion

Author: bhack

src/mini_eq/core.py

@@ -266,7 +266,10 @@ def ensure_preset_storage_dir() -> Path:
 def user_config_dir() -> Path:
     xdg_config_home = os.environ.get("XDG_CONFIG_HOME")
     if xdg_config_home:
-        return Path(xdg_config_home)
+        # codeql[py/path-injection] XDG_CONFIG_HOME is local process configuration; relative paths are rejected.
+        candidate = Path(xdg_config_home).expanduser()
+        if candidate.is_absolute():
+            return Path(os.path.normpath(str(candidate)))
 
     return Path.home() / ".config"
 
@@ -313,6 +316,22 @@ def preset_path_for_name(name: str) -> Path:
     return ensure_preset_storage_dir() / f"{preset_name}{PRESET_FILE_SUFFIX}"
 
 
+def delete_preset_file(name: str) -> None:
+    preset_name = sanitize_preset_name(name)
+    if not preset_name:
+        raise ValueError("preset name is empty")
+
+    storage_dir = ensure_preset_storage_dir()
+    dir_fd = os.open(storage_dir, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
+    try:
+        try:
+            os.unlink(f"{preset_name}{PRESET_FILE_SUFFIX}", dir_fd=dir_fd)
+        except FileNotFoundError:
+            return
+    finally:
+        os.close(dir_fd)
+
+
 def list_preset_names() -> list[str]:
     names = [
         path.stem

src/mini_eq/window_presets.py

@@ -13,6 +13,7 @@
 from .core import (
     PRESET_FILE_SUFFIX,
     PRESET_VERSION,
+    delete_preset_file,
     ensure_json_suffix,
     fader_band_count_for_profile,
     list_preset_names,
@@ -241,9 +242,7 @@ def on_preset_delete_dialog_done(
             return
 
         try:
-            preset_path = preset_path_for_name(preset_name)
-            if preset_path.exists():
-                preset_path.unlink()
+            delete_preset_file(preset_name)
             self.current_preset_name = None
             self.saved_preset_signature = self.controller.state_signature()
             self.refresh_preset_list()

tests/test_mini_eq_core.py

@@ -41,6 +41,22 @@ def test_default_preset_storage_uses_standalone_config_namespace(
     assert core.preset_storage_dir() == core.default_preset_storage_dir()
 
 
+def test_user_config_dir_ignores_relative_xdg_config_home(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    home_dir = tmp_path / "home"
+    monkeypatch.setenv("XDG_CONFIG_HOME", "relative-config")
+    monkeypatch.setattr(Path, "home", lambda: home_dir)
+
+    assert core.user_config_dir() == home_dir / ".config"
+
+
+def test_user_config_dir_normalizes_absolute_xdg_config_home(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path / "config" / ".." / "xdg-config"))
+
+    assert core.user_config_dir() == tmp_path / "xdg-config"
+
+
 def test_sanitize_preset_name_removes_invalid_chars_and_trims() -> None:
     assert core.sanitize_preset_name('  bad<>:"/\\\\|?* name...  ') == "bad name"
 
@@ -59,6 +75,46 @@ def test_preset_roundtrip_and_listing_uses_storage_dir(monkeypatch: pytest.Monke
     assert core.load_mini_eq_preset_file(core.preset_path_for_name("beta")) == beta_payload
 
 
+def test_delete_preset_file_removes_only_named_storage_file(monkeypatch: pytest.MonkeyPatch, tmp_path) -> None:
+    storage_dir = tmp_path / "mini-eq-presets"
+    monkeypatch.setattr(core, "PRESET_STORAGE_DIR", storage_dir)
+    payload = {"version": core.PRESET_VERSION, "name": "Alpha", "bands": []}
+
+    preset_path = core.preset_path_for_name("Alpha")
+    core.write_mini_eq_preset_file(preset_path, payload)
+
+    core.delete_preset_file("Alpha")
+
+    assert not preset_path.exists()
+
+
+def test_delete_preset_file_ignores_missing_file(monkeypatch: pytest.MonkeyPatch, tmp_path) -> None:
+    monkeypatch.setattr(core, "PRESET_STORAGE_DIR", tmp_path / "mini-eq-presets")
+
+    core.delete_preset_file("Missing")
+
+
+def test_delete_preset_file_rejects_empty_name(monkeypatch: pytest.MonkeyPatch, tmp_path) -> None:
+    monkeypatch.setattr(core, "PRESET_STORAGE_DIR", tmp_path / "mini-eq-presets")
+
+    with pytest.raises(ValueError, match="preset name is empty"):
+        core.delete_preset_file("../")
+
+
+def test_delete_preset_file_uses_sanitized_basename(monkeypatch: pytest.MonkeyPatch, tmp_path) -> None:
+    storage_dir = tmp_path / "mini-eq-presets"
+    monkeypatch.setattr(core, "PRESET_STORAGE_DIR", storage_dir)
+    outside_path = tmp_path / "outside.json"
+    sanitized_path = storage_dir / "outside.json"
+    outside_path.write_text("outside", encoding="utf-8")
+    core.write_mini_eq_preset_file(sanitized_path, {"version": core.PRESET_VERSION, "name": "outside", "bands": []})
+
+    core.delete_preset_file("../outside")
+
+    assert outside_path.read_text(encoding="utf-8") == "outside"
+    assert not sanitized_path.exists()
+
+
 def test_load_mini_eq_preset_file_rejects_invalid_shape(tmp_path) -> None:
     preset_path = tmp_path / "broken.json"
     preset_path.write_text('{"version": 1, "bands": "nope"}', encoding="utf-8")