cmd_add blank-prompt decision uses pre-prompt stale config #35

Open
opened 2026-10-15 11:11:27 +08:00 by Breadway · 0 comments
Owner

Found: full codebase audit 2026-10-15, by reading src/app.rs cmd_add.
Confidence: medium (needs two concurrent adds to trigger).
Location: src/app.rs:596,630-668.

existing is snapshotted before the interactive prompt from the startup-loaded cfg, but the locked Config::update closure reloads fresh config. Blank-means-keep vs blank-means-open is decided by the stale flag: a network created concurrently after our load gets its password wiped by our blank.

Suggested fix: recompute existence inside the update closure from the fresh cfg.

Found: full codebase audit 2026-10-15, by reading src/app.rs cmd_add. Confidence: medium (needs two concurrent adds to trigger). Location: src/app.rs:596,630-668. `existing` is snapshotted before the interactive prompt from the startup-loaded cfg, but the locked Config::update closure reloads fresh config. Blank-means-keep vs blank-means-open is decided by the stale flag: a network created concurrently after our load gets its password wiped by our blank. Suggested fix: recompute existence inside the update closure from the fresh cfg.
Sign in to join this conversation.
No labels
bug
ci
enhancement
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Breadway/breadcrumbs#35
No description provided.