From 8bad3116c09e65d00ed2952b53d5452a4646d14a Mon Sep 17 00:00:00 2001
From: "Oliver Surke (Gitea)" <gitea@surke.de>
Date: Mon, 11 May 2026 15:40:43 +0200
Subject: [PATCH] Fix path validator always failing on bash 3.2

In bash, strings cannot contain NUL bytes, so `$'\0'` expands to the empty
string. The pattern `*$'\0'*` collapsed to `**`, which matches every
non-empty value, so `validate_path` aborted on every real path with
"Path contains control chars".

- Drop the NUL check entirely (impossible to violate by construction).
- Use a single case statement for the newline and traversal checks; more
  predictable than chained [[ ... && ... ]] glob comparisons on bash 3.2.

Verified: paths with spaces, dots in basenames (~/.config, ~/.local), and
the iCloud bundle directory all pass; empty paths, "..", and embedded
newlines still reject.

Repro before fix:
  $ ./install.sh
  [ERR] Path contains control chars

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 lib/common.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/common.sh b/lib/common.sh
index 68a7a90..2e51504 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -52,13 +52,14 @@ ssr::confirm() {
     [[ "${reply,,}" == "y" ]]
 }
 
-# Validate a path is safe (no traversal, no shell metas). Used before any FS op.
+# Validate a path is safe (no newlines, no `..` traversal). Used before any FS op.
+# Note: bash strings cannot hold NUL bytes, so no separate NUL check needed.
 ssr::validate_path() {
     local p="$1"
     [[ -n "$p" ]] || ssr::die "Empty path"
-    [[ "$p" != *$'\n'* && "$p" != *$'\0'* ]] || ssr::die "Path contains control chars"
     case "$p" in
-        *..*) ssr::die "Path traversal rejected: $p" ;;
+        *$'\n'*) ssr::die "Path contains newline: $p" ;;
+        *..*)    ssr::die "Path traversal rejected: $p" ;;
     esac
 }