From 6e0432490ab1664b5e175fd52416a194db4c7b72 Mon Sep 17 00:00:00 2001
From: Artur Meski <artur@meski.io>
Date: Mon, 23 Mar 2026 21:08:36 +0000
Subject: [PATCH] Some checks just to be safe + link to the project

---
 src/enrich.rs |  7 +++++++
 src/mpd.rs    | 13 +++++++++++++
 src/report.rs |  2 +-
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/src/enrich.rs b/src/enrich.rs
index 596379b..b36d1d8 100644
--- a/src/enrich.rs
+++ b/src/enrich.rs
@@ -1220,6 +1220,13 @@ pub fn enrich_by_mbid(
     mbid: &str,
     cover_url_override: Option<&str>,
 ) {
+    // Reject MBIDs that contain path-traversal sequences or directory
+    // separators — a valid UUID contains only hex digits and hyphens.
+    if mbid.contains("..") || mbid.contains('/') || mbid.contains('\\') {
+        eprintln!("[error] Invalid MBID '{}': must not contain path components.", mbid);
+        return;
+    }
+
     let client = build_client();
     let covers = covers_dir();
 
diff --git a/src/mpd.rs b/src/mpd.rs
index e829f93..42e6ffc 100644
--- a/src/mpd.rs
+++ b/src/mpd.rs
@@ -1120,6 +1120,19 @@ pub fn run_mpd_cover_revalidate(config: &MpdConfig, conn: &Connection, artist: O
         };
 
         let dest = Path::new(&album.cover_url);
+
+        // Sanity-check: only write to paths inside the scrbblr covers
+        // directory. Rejects any DB row whose cover_url was tampered with to
+        // point outside our own data directory.
+        if !dest.starts_with(enrich::covers_dir()) {
+            eprintln!(
+                "  [warn] cover_url '{}' is outside the covers directory; skipping.",
+                album.cover_url
+            );
+            skipped += 1;
+            continue;
+        }
+
         let needs_repair = match std::fs::read(dest) {
             Ok(existing) => existing != processed,
             Err(_) => true,
diff --git a/src/report.rs b/src/report.rs
index 8a764f4..57ad6e3 100644
--- a/src/report.rs
+++ b/src/report.rs
@@ -813,7 +813,7 @@ pub fn render_html_report(conn: &Connection, limit: i64, all_time_limit: i64) ->
     h.open("<div class=\"hero\">");
     h.line("<h1>Listening Report</h1>");
     h.linef(format_args!(
-        "<div class=\"sub\">Generated by scrbblr on {}</div>",
+        "<div class=\"sub\">Generated by <a href=\"https://github.com/arturmeski/scrbblr\">scrbblr</a> on {}</div>",
         html_escape(&generated_at)
     ));
     h.close("</div>");