LuwanTerm v1.9.7
A malformed policy file stopped the app starting. A policy.json
containing __proto__ reached a lookup that resolved to Object.prototype -
truthy, and not iterable - and the destructuring beneath it threw. Policy is
read during boot, so that was not a bad setting being ignored; it was the
application refusing to open. A corrupted file or a fat-fingered fleet
deployment was enough.
Both stores now accept only keys they declare, checked as own properties
rather than with in, which every object answers yes to for __proto__ and
constructor.
An attack suite, run by npm test like everything else. Thirty-two checks
that push hostile input where hostile input can actually arrive - a server the
user connected to, a file somebody else wrote, a value arriving over IPC - and
assert the app refuses or sanitises rather than crashes or complies.
It covers download paths trying to escape the folder, policy and settings
carrying prototype keys, junk types, truncated JSON and two hundred levels of
nesting, a server sending a two-hundred-thousand-character line or naming five
thousand interfaces, an audit value with a newline in it trying to forge a
second log entry, and the check that keeps javascript: and file: away from
the shell. It was verified the only way worth doing: by putting the bug back
and watching the suite fail.
Smaller things it turned up. A server naming thousands of network
interfaces had them all sent to the interface and joined into a line of text;
that is capped at thirty-two now. And a server reporting no uptime was credited
with an uptime of zero, because Number('') is 0.
Also in this release
Turning beta builds off left you on a beta. Version comparison split on dots
alone, so 1.9.0-beta.51 read as newer than 1.9.0 - the opposite of what
semver says. A release now outranks its own prereleases.
Ticking "Include beta builds" asks first, which is the moment the decision is
actually made. Warning somebody once a beta has installed itself arrives too late
to act on.
The background image applies the moment you choose it, with opacity and blur
previewing live and Cancel putting back what was stored - the way the accent
colour always worked.
The away screen wakes on input rather than mouse movement, so a nudged desk
no longer counts as somebody working, and its clock lands on the minute instead
of drifting up to ten seconds behind.
README, SECURITY, CODE_OF_CONDUCT, CONTRIBUTING and SUPPORT rewritten at
roughly twice the length, with badges. SECURITY says what is defended and, at
equal length, what is not. CONTRIBUTING states the rule this project runs on - a
test that cannot fail is not a test. A roadmap says what
2.0 is for.
Windows will warn on first run. Click More info, then Run anyway.
That is SmartScreen, which checks whether an app is signed and widely run -
not whether it contains anything harmful. These builds are unsigned, so it
warns until a certificate is bought or enough people have downloaded them.
The checksums below let you confirm you have the file that was published.
Download
- LuwanTerm-1.9.7-setup.exe - installer, adds a Start Menu entry and updates itself
- LuwanTerm-1.9.7-portable.exe - single file, nothing installed
Verify what you downloaded - SHA-256:
61b36d3616dea476e9198f5617002afb2664dccb072bfc2ca2f408c06768a3c3 LuwanTerm-1.9.7-portable.exe
624d39bf962caf447978203312832b919a21d8a54fe2be744d7f2872ccb66545 LuwanTerm-1.9.7-setup.exe
On Windows: Get-FileHash .\LuwanTerm-1.9.7-setup.exe -Algorithm SHA256
Full changelog: v1.9.6...v1.9.7