TransferService: harden OBEX incoming-file handling (7 audit findings) - #3320

Open

geraldo-netto wants to merge 44 commits into

blueman-project:mainfrom

geraldo-netto:fix/transfer-service-hardening

Commits on Jun 2, 2026

docs: add agent guidelines and project rescan findings

geraldo-netto
and
claude
committed
3335915
docs: close wire-1/wire-2, reject wire-3 in TODO

geraldo-netto
and
claude
committed
b008ae5
docs: close SpeedCalc perf item, park GTK-bound perf items

geraldo-netto
and
claude
committed
231d225
docs: close security input-validation items

geraldo-netto
and
claude
committed
bb81c4f
docs: close reliability crash-guard items

geraldo-netto
and
claude
committed
a337e6f

Commits on Jun 14, 2026

Merge remote-tracking branch 'origin/main' into chore/project-rescan-todo
geraldo-netto
committed
6b6838a
docs: add review categories from rescan notes
geraldo-netto
committed
4466eec
docs: record expanded rescan findings
geraldo-netto
committed
339d9ca

Commits on Jun 15, 2026

docs: add follow-up rescan findings
geraldo-netto
committed
42292dc
Merge remote-tracking branch 'origin/main' into chore/project-rescan-todo
geraldo-netto
committed
16ce811
docs: rescan project todo findings
geraldo-netto
committed
f2a6b0f

Commits on Jun 19, 2026

docs: expand AGENTS.md review categories with definitions

geraldo-netto
and
claude
committed
9361c8b
docs: rescan project, add findings for uncovered AGENTS.md categories

geraldo-netto
and
claude
committed
3b072d4
docs: drop TODO items already implemented on other branches

geraldo-netto
and
claude
committed
c0ea890
docs: sort TODO tables by description; document the convention

geraldo-netto
and
claude
committed
9e25748
docs: drop TODO items implemented in perf/bluez-base-property-cache

geraldo-netto
and
claude
committed
38cd4c6
docs: drop TODO items implemented in perf/devicelist-clear-discovery

geraldo-netto
and
claude
committed
e117a4e
docs: add rule against documenting obvious code

geraldo-netto
and
claude
committed
0196eea
fix(functions): correct format_bytes unit boundaries (fuzz-4)

geraldo-netto
and
claude
committed
c9be5ba
test(functions): pin adapter_path_to_name behavior (fuzz-6)

geraldo-netto
and
claude
committed
08805e8
fix(functions): extract parse_os_release and keep values with "=" (fuzz-5, data-3)

geraldo-netto
and
claude
committed
a2d8de3
refactor(functions): resolve have() via shutil.which (dep-8, plat-1)

geraldo-netto
and
claude
committed
23a0c68
fix(functions): degrade gracefully when /dev/log is missing (plat-8)

geraldo-netto
and
claude
committed
7c8bef6
feat(functions): validate --loglevel with choices and help (cli-1)

geraldo-netto
and
claude
committed
c27650d
fix(functions): log instead of print in check_bluetooth_status (obs-1)

geraldo-netto
and
claude
committed
66c0417
fix(functions): guard set_proc_title for non-Linux platforms (leg-5)

geraldo-netto
and
claude
committed
85ceebd
feat(functions): add argv contract to launch() (cmd-2, api-2)

geraldo-netto
and
claude
committed
dc91cba
docs(functions): document create_logger and create_parser (doc-1)

geraldo-netto
and
claude
committed
87d0472
docs(todo): reject dead-1/2/3 as false positives

geraldo-netto
and
claude
committed
1ad3f68
docs(todo): park leg-1 and leg-2 GTK3 deprecation refactors

geraldo-netto
and
claude
committed
5fe6e5b
docs(todo): close NetConf.py items implemented in fix/netconf-hardening

geraldo-netto
and
claude
committed
844e94c
docs(todo): close Sendto.py items implemented in fix/sendto-hardening

geraldo-netto
and
claude
committed
7ae412a

Commits on Jun 20, 2026

security: escape configured share path in invalid-dir notification (sec-1)

geraldo-netto
and
claude
committed
563144c
i18n: translate "Reset to default" notification action (i18n-3)

geraldo-netto
and
claude
committed
fbd806f
fix: capture allowed address in removal timeout closure (rel-10)

geraldo-netto
and
claude
committed
8dedf40
fix: track pending OPP authorizations by transfer path (sm-8)

geraldo-netto
and
claude
committed
1ae7d1d
fix: reserve incoming-file destination atomically (data-1)

geraldo-netto
and
claude
committed
7bdc824
refactor: inject a device resolver into the OBEX Agent (dec-1)

geraldo-netto
and
claude
committed
c6bc292
test: cover OBEX transfer authorization and completion paths (test-3)

geraldo-netto
and
claude
committed
263a788
chore: drop rescan scaffolding docs from this branch

geraldo-netto
and
claude
committed
1b37e86
docs: note the DeviceResolver raise contract (dec-1)

geraldo-netto
and
claude
committed
ecd17f2
fix: correct transfer counters, instance handler list, and XDG fallback

geraldo-netto
and
claude
committed
ae3dd09
style: use logging.exception in except handlers (Functions.py)

geraldo-netto
and
claude
committed
7c65dc5
test(dns): wait for changed signal instead of draining pending events

geraldo-netto
and
claude
committed
4484417