reject profile names that resolve outside data-dir

The character check allowed "." and "..", which are made entirely of allowed
characters and still walk out of the directory, so the traversal guard only
stopped the cases containing a separator. Reject both by name and check the
resolved path against the profile root as well, since the character set
constrains the characters rather than where they point.

Also drop the MouseUtils and KeyboardUtils built in run_account and never
used, RewardsTaskUtils builds its own, along with the two imports that
leaves unused, and say "lowercased" in the no-source warning, which is what
the code returns.
This commit is contained in:
Ethan Stoner
2026-08-27 15:26:01 -07:00
parent 2f960c6a03
commit 1a224919b2
3 changed files with 23 additions and 9 deletions
-5
View File
@@ -5,8 +5,6 @@ import sys
import log_utils
import accounts
import rewards_tasks
import mouse_trajectory
import mimic_typing
from selenium import webdriver
from selenium.common.exceptions import SessionNotCreatedException
@@ -54,9 +52,6 @@ def run_account(account: accounts.Account) -> bool:
return False
try:
mouse = mouse_trajectory.MouseUtils(driver)
keyboard = mimic_typing.KeyboardUtils(driver)
rewards = rewards_tasks.RewardsTaskUtils(driver)
rewards.complete_all_tasks()
finally: