Highlights
🔒 Cryptex DDI cache stays inside its directory
fetch_cryptex_ddi() writes each Cryptex1 payload to the path that the downloaded BuildManifest.plist declares for it. That path is now checked to stay inside the cache directory, and load_cryptex1_assets() applies the same check when reading. An absolute path or a .. component raises DevicePathError before anything is written. The manifest is also written last, so an interrupted download no longer leaves a partial cache that the next call treats as complete. Thanks @fidel-karsto for the report and the fix.
What's Changed
- 9df3c37 cryptexd: Validate build manifest payload paths (#2047) (@fidel-karsto)
New Contributors
- @fidel-karsto made their first contribution in #2047
Full Changelog: v11.35.1...v11.35.2