MyFileSync is a local power-user tool that reads/writes arbitrary user-selected paths. It is not a sandboxed web app. Risks:
- Destructive sync (mirror delete on wrong target)
- Path traversal via malicious job files
- Sync to unintended locations via symlink tricks
All paths from renderer/CLI/job files pass through main-process normalization:
requireAbsolute(path)— reject relative, empty,..escape after normalize.- Resolve to absolute with
path.resolveon Windows; preserve UNC (\\server\share). - Long paths — prefix
\\?\when ≥ 260 chars for Win32 APIs (ADS stream paths). - Reject unknown URL schemes (
file:/ UNC / drive letters only).
Job JSON stores paths as typed strings; validate on load with Zod.
| Control | Behavior |
|---|---|
| Review before sync | Default: compare then explicit Sync click (D10) |
| Mirror deletes | Show delete count in confirm dialog when > 0 (skippable via Don’t show again) |
| Permanent delete | Confirm when multiple items or folder trees |
| Recycle Bin default | D6 — SHFileOperation with FOF_ALLOWUNDO |
| Read-only dest | Clear dest FILE_ATTRIBUTE_READONLY for the write/delete, then match the source (D22). ACL permission denied still blocks with a plain message. |
| Same path guard | Reject left === right after normalize |
Compare may read the NTFS USN journal (FSCTL_QUERY_USN_JOURNAL / FSCTL_READ_USN_JOURNAL) to skip unchanged folders. It does not create or delete the journal. Paths outside the pair roots are ignored.
- Stream names validated: forbid
< > : " / \ | ? *in names (allow C0 controls per NTFS parity). - Do not execute stream contents — treat as binary/text data only.
Zone.Identifieris data, not executable — still user-controlled bytes in preview pane (sanitize display).
- Context isolation enabled; no
nodeIntegrationin renderer. - All IPC payloads validated with Zod.
- Result envelope — never throw raw Error strings to renderer without code.
- INI/JSON import from disk is user-initiated only.
- Cap job file size (e.g. 10 MB) and pair count (e.g. 256 pairs).
- Logs may contain full paths — store under
userData/logs; never auto-upload. - Optional export is user-driven.
- Encryption at rest for job files (user may use EFS/BitLocker on disk).
- Multi-user ACL management (OS handles permissions; app surfaces errors clearly).