Unescaped paths produce invalid launchd plist XML #6

New issue

Closed

opened 2026-08-11 10:25:48 +00:00 by aav · 0 comments

aav commented

2026-08-11 10:25:48 +00:00

Owner

plist() (src/platform/macos.rs:163) interpolates the binary and config paths into XML without escaping, so a path containing & or < produces a malformed plist that launchd rejects.

Failure scenario: a config lives at a path with an ampersand, e.g. /usr/local/etc/silta 1&2/forwards.toml (root-owned, so it passes the safety check). setup --persistent writes a plist whose <string> contains a bare &, which is invalid XML; launchd silently refuses to load it at boot. After the next reboot the interface is never recreated, every dedicated-address forward fails, and nothing points at the unloadable plist as the cause.

Fix direction: XML-escape the interpolated paths (&, <, >, ", ') before writing the plist.

Source: high-effort code review, CONFIRMED. Area: setup/platform.

`plist()` (src/platform/macos.rs:163) interpolates the binary and config paths into XML without escaping, so a path containing `&` or `<` produces a malformed plist that launchd rejects. **Failure scenario:** a config lives at a path with an ampersand, e.g. `/usr/local/etc/silta 1&2/forwards.toml` (root-owned, so it passes the safety check). `setup --persistent` writes a plist whose `<string>` contains a bare `&`, which is invalid XML; launchd silently refuses to load it at boot. After the next reboot the interface is never recreated, every dedicated-address forward fails, and nothing points at the unloadable plist as the cause. **Fix direction:** XML-escape the interpolated paths (&, <, >, ", ') before writing the plist. Source: high-effort code review, CONFIRMED. Area: setup/platform.

aav added the

bug

priority

normal

labels

2026-08-11 10:25:48 +00:00

aav self-assigned this

2026-08-11 10:27:24 +00:00

aav referenced this issue from a commit

2026-08-11 11:03:14 +00:00

Escape paths written into the launchd plist

aav closed this issue