Juan Fernando Castro
cdfd38bd4b
The fs-path-to-uid permission rewriter split permission strings on the raw \`fs:\` substring instead of parsing on component boundaries. A path can itself contain \`fs:\` — a home dir named \`…fs\`, or \`fs\` in the mode position — and the raw split mistook that for the mode delimiter. Crafting \`fs:/<victim>fs:junk:read\` made the split do two things at once: it dropped the \`junk:read\` mode, and it consumed the trailing \`fs\`, turning the harmless-looking nonexistent path shown in the consent dialog into the victim's real home path. The rewriter then stored a bare \`fs:<home_uuid>\`, which subsumes every mode via parent-permission matching — full read+write+delete from a request the user saw as \`junk:read\`. Parse with PermissionUtil.split() in both matches() and rewrite(), matching every other permission parser, and locate the \`fs\` component by position (after an optional \`manage\` prefix). The path component is now exactly what sits between \`fs\` and the next unescaped colon, and all trailing components are preserved as the mode — so an embedded \`fs:\` is data, never a delimiter. The crafted input now addresses the nonexistent \`/<victim>fs\` and 404s. Regression tests pin both halves: the exact PoC must 404, and an \`fs:\` in the mode position must survive the rewrite instead of collapsing to a bare permission. Both fail on the old rewriter and pass on the fix.
The Open-Source Internet Computer!
« LIVE DEMO »
Puter.com
·
App Store
·
Developers
·
X
Puter
Puter is an advanced, open-source, self-hostable internet computer designed to be feature-rich, fast, and highly extensible.
For Users
Puter's goal is to provide you with every app and feature you need to work, create, and play under one roof. From a simple Notepad and Voice Recorder to Spreadsheet and Camera, Puter wants to be the all-in-one solution for your digital life.
For Developers
Puter provides everything you need to build and publish web apps and games. From AI to Cloud Storage and Database to Serverless Workers, Puter has you covered. Puter also helps you get users! Once you build your app, you can publish it on our App Store to reach and monetize users.
Getting Started
💻 Local Development
git clone https://github.com/HeyPuter/puter
cd puter
npm install
npm start
→ This should launch Puter at http://puter.localhost:4100
🚀 Self-Hosting
Linux/macOS
curl -fsSL https://puter.com/selfhost | sh
Windows
irm https://puter.com/selfhost?os=windows | iex
→ For more details, see Self-Hosting Puter.
☁️ Puter.com
Puter is available as a hosted service at puter.com.
Support
Connect with the maintainers and community through these channels:
- Bug report or feature request? Please open an issue.
- X (Twitter): x.com/HeyPuter
- Security issues or abuse reports? security@puter.com
- Email maintainers at hi@puter.com
We are always happy to help you with any questions you may have. Don't hesitate to ask!
License
This repository, including all its contents, sub-projects, modules, and components, is licensed under AGPL-3.0 unless explicitly stated otherwise. Third-party libraries included in this repository may be subject to their own licenses.
Translations
- Arabic / العربية
- Armenian / Հայերեն
- Bengali / বাংলা
- Chinese / 中文
- Danish / Dansk
- English
- Farsi / فارسی
- Finnish / Suomi
- French / Français
- German / Deutsch
- Hebrew/ עברית
- Hindi / हिंदी
- Hungarian / Magyar
- Indonesian / Bahasa Indonesia
- Italian / Italiano
- Japanese / 日本語
- Korean / 한국어
- Malay / Bahasa Malaysia
- Malayalam / മലയാളം
- Dutch / Nederlands
- Polish / Polski
- Odia / ଓଡ଼ିଆ
- Portuguese / Português
- Punjabi / ਪੰਜਾਬੀ
- Romanian / Română
- Russian / Русский
- Spanish / Español
- Swedish / Svenska
- Tamil / தமிழ்
- Telugu / తెలుగు
- Thai / ไทย
- Turkish / Türkçe
- Ukrainian / Українська
- Urdu / اردو
- Vietnamese / Tiếng Việt