Scour 0.2.0-alpha.6 — security and file-safety fixes, smoother scrolling

Pre-release. Update if you installed 0.2.0-alpha.5 or earlier: this release fixes security and file-safety bugs found in a review of the whole program and in an outside QA pass. Tested on one Linux machine in daily use; the packages were installed in clean Debian 11 and 12, Ubuntu 22.04 and 24.04 and Fedora containers, where the service indexed and found a file and every face answered. The Windows zip builds; this release has not been started on Windows.

Security

• A folder's name could run script in the browser page. The report's path line wrote folder names into the page unescaped, so a folder named <img src=x onerror=…> — from an archive, a clone, a download — ran script holding the page's token once the report was opened inside it. Fixed, and the page is now served under a content security policy that runs only its own script.
• Another account on the same machine could use the browser bridge. The page's token travels on the browser's command line, which every account can read. The bridge now refuses any connection whose other end belongs to another account, and Origin and Host must name the bridge exactly.
• A program is started only after the browser page asks. Opening a runnable file used to start it on the spot.
• A file name could send escape sequences to the terminal running scour; control characters are shown as ? at a terminal.
• The service's watching descriptor no longer reaches the programs it starts, such as thumbnailers.

File safety

• A name containing a newline sent another file to the trash. Selecting victim\nsuffix.txt in the browser and moving it to the trash moved victim. Paths now travel as a JSON array.
• The trash could write over a file already in it when that file's .trashinfo was missing. A name now has to be free in both places, and the move never replaces anything.
• Hard links are no longer reported as duplicates, and three same-sized files whose first differs from the other two now give the two that match.
• Files whose names are not valid UTF-8 can be opened, renamed and trashed from every face.
• A permanent delete says when a folder takes everything inside it.

Window

• Scrolling is smoother: the list reuses its rows instead of rebuilding them, which cut the work of a fast scroll by about a quarter and brought its slowest frames well inside a frame's time.
• Rows below the first screen of a new search no longer stay blank on an index that is not changing.
• F2 renames, Ctrl+Enter opens the folder, Escape cancels the rename box, and the rename box takes the keys as it opens.

Packages and the command line

• Live watching from a package is one command: sudo /usr/libexec/scour/install-service. Without it nothing is missed, but changes are found by walking, which is slower.
• scour stop stops the service so it starts again with an edited config.toml. The README now shows how to index more than the home directory.

Installing

• The tarball's install.sh needs no password. It installs the binaries, the menu entry, the icon and the GNOME Shell extension, binds Super+F, and at a terminal offers to start the service with your session.
• .deb and .rpm packages, all seven binaries. Installing starts nothing; systemctl --user enable --now scourd.service does, and any face starts the service itself when it finds none.
• The Linux binaries ask for glibc 2.30 at most: Debian 11, Ubuntu 22.04, RHEL 9 and later.
• sha256sum -c SHA256SUMS checks the downloads.

Known limits

• Raising an open window, and the file manager's, needs the GNOME extension. Log out and back in once after installing.
• The window cannot drag files out; Copy the file and paste does the same. The browser window can.
• On Ubuntu 22.04 and Debian 11 the polkit rule that lets an account start its own service without a password is not read (their polkit is too old); the service still starts at boot.
• Inside a Flatpak nothing is watched live.
• The index format may change between releases.