Commit Graph

13 Commits

Author SHA1 Message Date
Tarasov Aleksandr 6114b9a7f8 🔒 [security] Set restricted permissions on socket and runtime directory (#40)
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-03-21 21:03:48 +03:00
Tarasov Aleksandr 3c2e943e18 fix(security): eliminate TOCTOU vulnerability during socket removal (#36)
Directly attempt to remove the daemon socket file and handle NotFound errors
instead of checking for its existence first. This prevents a potential
race condition where the file could be replaced between the check and
the removal.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-03-08 02:13:19 +03:00
Tarasov Aleksandr 261f83efd4 🧹 Code Health: Handle AudioPlayer initialization errors safely (#35)
* 🧹 Refactor: Replace unsafe unwrap in get_audio_player

Co-authored-by: arabianq <55220741+arabianq@users.noreply.github.com>

* 🧹 Refactor: Replace unsafe unwrap in get_audio_player

Resolved GitHub CI failure where a syntax error was introduced due to a bad automated merge with main. Rebased cleanly to ensure only the get_audio_player code health changes are included.

Co-authored-by: arabianq <55220741+arabianq@users.noreply.github.com>

* Delete tests/perf_play.rs

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-03-08 01:36:25 +03:00
Tarasov Aleksandr c99d0749e3 🔒 Add request size limit to daemon socket IPC to prevent OOM panic (#31)
The daemon was allocating memory based on an unverified length prefix
sent over the unauthenticated Unix socket, potentially allowing a malicious
client to cause an Out-Of-Memory panic (DoS). A 10 MB size limit has been
introduced.

Note: The previously reported `unwrap()` panic on invalid JSON payloads
was already fixed and replaced with a safe `match` block in a prior commit.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-03-08 00:34:50 +03:00
Tarasov Aleksandr 89ce111542 🔒 [security fix] Handle serialization failures in daemon commands and socket communication. (#16)
- Replaced `.unwrap()` with proper error handling during JSON serialization in `GetStateCommand`, `GetTracksCommand`, and `GetFullStateCommand`.
- Added error handling for malformed client requests in the daemon's main loop.
- Ensured the daemon stays running even if serialization or deserialization fails.
- Handled potential errors from `get_all_devices()`.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-03-06 23:02:07 +03:00
arabianq 92a576de37 fix(pwsp-daemon): added retries to link_player_to_virtual_mic()
https://github.com/arabianq/pipewire-soundpad/issues/15
2026-03-06 15:19:06 +03:00
arabianq 58e5f039be feat(cli, flatpak): implemented kill action for pwsp-cli.
use it instead of pkill in the flatpak wrapper
2026-02-23 13:40:41 +03:00
arabianq 3e6a8b6e79 feat: first attemp to support playing multiple tracks in parallel 2026-01-24 22:18:42 +03:00
arabianq fe8fec4ea7 fix: loop -> tokio::select! in pwsp-daemon main loop for less CPU usage 2026-01-02 04:12:49 +03:00
arabianq 7583e72687 fix: remove debug print statements from commands loop 2026-01-02 04:09:21 +03:00
arabianq 408f5317c4 feat: implemented loop functionality on daemon level 2026-01-02 02:25:30 +03:00
arabianq 3672d6f43e feat: now pwsp-daemon main loop is separated into commands_loop and player_loop 2026-01-02 02:10:58 +03:00
arabianq dee908a347 1.0.0 rewrite 2025-12-16 21:08:47 +03:00