fix: print useful error on write fail

assets/locales/en.json

@@ -177,7 +177,7 @@
   },
   "couldNotSaveDialog": {
     "title": "Could not write to disk",
-    "message": "There was an error writing to the disk. Please try again."
+    "message": "There was an error writing to \"{ dir }\": \"{ error }\". Please try again or inspect logs for more details."
   },
   "launchAtLoginNotSupported": {
     "title": "Error",

src/dialogs/prompt/index.js

@@ -48,7 +48,8 @@ module.exports = async function showPrompt (options) {
       ? pallette.dark.background
       : pallette.default.background,
     webPreferences: {
-      nodeIntegration: true
+      nodeIntegration: true,
+      contextIsolation: false
     },
     ...options.window
   })

src/download-cid.js

@@ -1,4 +1,4 @@
-const { join } = require('path')
+const { join, dirname } = require('path')
 const fs = require('fs-extra')
 const i18n = require('i18next')
 const isIPFS = require('is-ipfs')
@@ -18,8 +18,25 @@ const SHORTCUT = IS_MAC
   : 'CommandOrControl+Alt+D'
 
 async function saveFile (dir, file) {
-  const location = join(dir, file.path)
-  await fs.outputFile(location, file.content)
+  const destination = join(dir, file.path)
+  // ensure files are saved within the dir picked by the user
+  if (!destination.startsWith(dir)) {
+    throw new Error(`unable to create '${file.path}' outside of '${dir}'`)
+  }
+  // abort if destination already exists (safer default than overwriting user data)
+  if (fs.existsSync(destination)) {
+    throw new Error(`unable to create '${file.path}' as it already exists at '${destination}'`)
+  }
+  // abort if symlinks in the target dir point outside of it
+  const subDir = dirname(destination)
+  if (fs.existsSync(subDir)) {
+    const realRootDir = await fs.realpath(dir)
+    const realSubDir = await fs.realpath(subDir)
+    if (!realSubDir.startsWith(realRootDir)) {
+      throw new Error(`unable to create subdir '${realSubDir}' outside of '${realRootDir}'`)
+    }
+  }
+  await fs.outputFile(destination, file.content)
 }
 
 async function get (ipfs, cid) {
@@ -129,11 +146,12 @@ async function downloadCid (ctx) {
       shell.showItemInFolder(join(dir, files[0].path))
     }
   } catch (err) {
-    logger.error(`[cid download] ${err.toString()}`)
+    const errMsg = err.toString()
+    logger.error(`[cid download] ${errMsg}`)
 
     showDialog({
       title: i18n.t('couldNotSaveDialog.title'),
-      message: i18n.t('couldNotSaveDialog.message'),
+      message: i18n.t('couldNotSaveDialog.message', { dir, error: errMsg }),
       buttons: [i18n.t('close')]
     })
   }