[Client] Warn when data paths point inside the program directory (#7473)

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>

libcockatrice_settings/libcockatrice/settings/paths_settings.cpp

@@ -2,6 +2,8 @@
 
 #include "libcockatrice/settings/settings_manager.h"
 
+#include <QDir>
+#include <QStringList>
 #include <QVariant>
 
 class QObject;
@@ -121,3 +123,52 @@ void PathsSettings::setSpoilerDatabasePath(const QString &_spoilerDatabasePath)
     setValue(_spoilerDatabasePath, "spoilerDatabase");
     emit cardDatabasePathChanged();
 }
+
+QStringList PathsSettings::pathsInsideDir(const QString &baseDir) const
+{
+    QStringList offenders;
+    const auto check = [&offenders, &baseDir](const QString &path) {
+        if (!path.isEmpty() && isInsideDir(path, baseDir)) {
+            offenders.append(QDir::cleanPath(path));
+        }
+    };
+
+    check(getDeckPath());
+    check(getFiltersPath());
+    check(getReplaysPath());
+    check(getPicsPath());
+    check(getCustomPicsPath());
+    check(getThemesPath());
+    check(getCardDatabasePath());
+    check(getCustomCardDatabasePath());
+    check(getTokenDatabasePath());
+    check(getSpoilerCardDatabasePath());
+    check(getRedirectCachePath());
+
+    offenders.removeDuplicates();
+    return offenders;
+}
+
+bool PathsSettings::isInsideDir(const QString &path, const QString &baseDir)
+{
+#if defined(Q_OS_WIN) || defined(Q_OS_MACOS)
+    // Windows and default macOS volumes are case-insensitive filesystems.
+    constexpr Qt::CaseSensitivity caseSensitivity = Qt::CaseInsensitive;
+#else
+    constexpr Qt::CaseSensitivity caseSensitivity = Qt::CaseSensitive;
+#endif
+    const QString base = QDir::cleanPath(baseDir);
+    const QString cleaned = QDir::cleanPath(path);
+    const QString prefix = base.endsWith(QLatin1Char('/')) ? base : base + QLatin1Char('/');
+    return cleaned == base || cleaned.startsWith(prefix, caseSensitivity);
+}
+
+bool PathsSettings::getAppDirWarningAcknowledged() const
+{
+    return getValue("appDirWarningAcknowledged").toBool();
+}
+
+void PathsSettings::setAppDirWarningAcknowledged(bool _appDirWarningAcknowledged)
+{
+    setValue(_appDirWarningAcknowledged, "appDirWarningAcknowledged");
+}

libcockatrice_settings/libcockatrice/settings/paths_settings.h

@@ -4,6 +4,7 @@
 #include "settings_manager.h"
 
 #include <QString>
+#include <QStringList>
 #include <libcockatrice/interfaces/interface_paths_settings_provider.h>
 #include <qtmetamacros.h>
 
@@ -27,6 +28,24 @@ public:
     [[nodiscard]] QString getSpoilerCardDatabasePath() const override;
     [[nodiscard]] QString getRedirectCachePath() const override;
 
+    /**
+     * @brief Returns the configured paths that resolve inside baseDir.
+     *
+     * Comparison is lexical (QDir::cleanPath); symlinks are not resolved, so a
+     * path that only reaches baseDir through a symlink is not reported.
+     */
+    [[nodiscard]] QStringList pathsInsideDir(const QString &baseDir) const;
+
+    /**
+     * @brief Whether path resolves inside baseDir, as a single-path check.
+     *
+     * A path counts as inside when it equals baseDir or is nested below it;
+     * a sibling sharing the name prefix (baseDir + "2") does not.
+     */
+    [[nodiscard]] static bool isInsideDir(const QString &path, const QString &baseDir);
+
+    [[nodiscard]] bool getAppDirWarningAcknowledged() const;
+
     void setDeckPath(const QString &_deckPath);
     void setFiltersPath(const QString &_filtersPath);
     void setReplaysPath(const QString &_replaysPath);
@@ -37,14 +56,17 @@ public:
     void setCustomCardDatabasePath(const QString &_customCardDatabasePath);
     void setTokenDatabasePath(const QString &_tokenDatabasePath);
     void setSpoilerDatabasePath(const QString &_spoilerDatabasePath);
+    void setAppDirWarningAcknowledged(bool _appDirWarningAcknowledged);
 
 signals:
     void cardDatabasePathChanged();
     void picsPathChanged();
     void themeChanged();
 
-private:
+public:
     explicit PathsSettings(const QString &settingPath, QObject *parent = nullptr);
+
+private:
     PathsSettings(const PathsSettings & /*other*/);
 };