Skip to content

DiskX 1.0.2 — security release

Choose a tag to compare

View all tags
@avantigroupai avantigroupai released this 11 Aug 23:40
· 2 commits to main since this release
Immutable release. Only release title and notes can be modified.
1.0.2
98ccd2b

Security release. Fixes a reproducible crash that lets any scanned folder kill the app, plus a set of deletion-safety hardening changes. Everyone on 1.0.0 or 1.0.1 should update.

Fixed

Crash on hostile file sizes (denial of service). File sizes reported by the filesystem were summed with trapping arithmetic. 1,200 sparse files of 2^53 bytes — which occupy zero disk, cost nothing to create and travel happily inside a zip, disk image or network share — overflow Int64 and abort DiskX mid-scan with SIGTRAP. The payload is invisible in Finder and du, and it kills the app on every retry, permanently denying you the ability to scan that location. Sizes are now clamped when parsed and every aggregate saturates instead of trapping.

Deletions are now bound to file identity. A path is not a handle. Nothing tied the row you approved in the confirmation sheet to the file that actually got deleted, and the pre-flight check only asked whether something existed at that path. DiskX now captures (device, inode, type) when the plan is built and re-verifies it immediately before acting, refusing any item whose identity changed in between.

Trash results are verified. trashItem reports success for an item that already lives in the Trash, so DiskX detached the row and credited bytes that were never reclaimed. It now confirms the item actually moved before reporting it.

Protected system paths stay protected. The system-path check stopped applying below two directory levels, so /private/var/db and everything beneath it was offered for deletion as "Yours — review". Protection is now inherited by the entire subtree.

Scanner parser hardened. The getattrlistbulk entry walk trusted the entry length, the signed name offset and the name length from the buffer, and read the name as an unbounded C string. All are now validated against the entry and the buffer.

Also

  • DISKX_TRACE — which streamed every scanned path to stderr — is compiled out of release builds entirely.
  • Goal mode no longer crashes on very large input.
  • A directory with hundreds of thousands of entries can no longer wedge the UI; the status bar reports how many rows are not listed.
  • Bulk-trash bookkeeping no longer does O(n²) path matching on the main thread.
  • Security-scoped bookmarks are released properly, resolved without UI or mounting, and no longer discarded when a volume is merely unplugged.
  • The size column no longer collides with the scroll bar.

54 tests, including regression tests for the reproduced crash and the identity-swap refusal.

Install

Universal (Apple Silicon + Intel), macOS 14 Sonoma or later.

Important

This build is Developer ID signed but not notarized, unlike 1.0.1. macOS will quarantine it on first launch. Open it once with right-click → Open → Open, or clear the flag:

xattr -dr com.apple.quarantine /Applications/DiskX.app

A notarized build will follow as 1.0.2.x/1.0.3. The security fixes were considered more urgent than waiting for the notarization credentials.

To scan ~/Library and system paths, grant Full Disk Access in System Settings → Privacy & Security.

SHA-256  e7e8f697a4a301634c4a88c98bb5131af69068424faab0b3d6367f3adc81007a
Assets 4
Loading