v0.8.3

Perth v0.8.3

Diff since v0.8.2

Perth.jl v0.8.3 — three ways in, closed

A security release. Every user of 0.8.2 or earlier should update, and anyone who runs Perth.share!() on a network they do not fully trust should update before running it again. No API change, no data change: a project written by any 0.8 is read exactly as it was. Full changelog: https://github.com/dantebertuzzi/Perth.jl/blob/main/CHANGELOG.md

Security

• A project file could overwrite an unrelated file on disk. file_path is the mirror path of this machine, and the writer never puts it in a .perth.jl — the format's own comment says so. The reader did not enforce it: a hand-written or hostile file that declared the field had it accepted, and the first save wrote the project over whatever it pointed at — ~/.ssh/authorized_keys, a source file, a document — silently. It was reachable through Perth.load, which is exactly the documented way to open a file somebody sent you. The parser refuses such a file outright now, which covers every reader at once.

• A few kilobytes of [[[[[ killed the server process. Julia's own parser is recursive and dies on deeply nested brackets — not a catchable exception, a core dump — so Meta.parseall never returned. Project source arrives over HTTP through /api/import, so any client that could reach the API could take the server down. Source is now checked before parsing: 4 MB and 32 levels of nesting, against the four levels a real file uses. Brackets inside strings and comments do not count, so a task named Coleta [campo] (fase 1) is still just a name.

• What reaches the host machine is now host-only. With sharing on, any guest on the network could set a project's mirror path, browse the host's directory tree and start the kanban process. The mirror was the worst of the three: the path resolver accepts any path ending in .jl verbatim, so a guest could point it at ~/.julia/config/startup.jl and have the host overwrite that file on its next save — the .jl requirement, which looks like a guard, is exactly what puts the most sensitive target in reach. These three are not project edits, they are access to the machine, and they answer 403 to anyone but the machine running Perth now, like the sharing toggle and the access key already did.

Editing projects over a shared session is deliberately untouched — that is a different question, and a read-only switch is the right shape for it.

Added

• The UI background accepts AVIF, still or animated. It is the same risk class as the WebP already accepted — a raster codec the browser decodes — unlike SVG, which stays out. The check is still by content: an ftyp box with any other brand, MP4 included, is refused.

Notes

• Animated backgrounds, as measured in Chrome: GIF, animated WebP and animated AVIF all play. APNG is accepted — it carries the PNG signature — and it animates when the file is opened on its own, but it stayed on the first frame as a CSS background in every sample we took, while a GIF with identical timing advanced normally. Nothing in Perth touches the frames, so if animation matters, prefer GIF, WebP or AVIF.