From 11344c39f5bbc960bb343f7e95a45d0d0090c7a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christian=20K=C3=B6nig?= <github@yubiuser.dev>
Date: Thu, 23 Oct 2025 22:09:55 +0200
Subject: [PATCH] Prevent  URLs like file:/./ to circumvent permission check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Christian König <github@yubiuser.dev>
---
 gravity.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gravity.sh b/gravity.sh
index 1e394811..8f1005a0 100755
--- a/gravity.sh
+++ b/gravity.sh
@@ -726,7 +726,7 @@ gravity_DownloadBlocklistFromUrl() {
     # to match the effective runtime user of FTL; otherwise, check the current user's read access
     # (e.g., in Docker or when invoked by a non-root user). The target must
     # resolve to a regular file and be readable by the evaluated user.
-  if [[ "${url}" == "file://"* ]]; then
+  if [[ "${url}" == "file:/"* ]]; then
     # Get the file path
     file_path=$(echo "${url}" | cut -d'/' -f3-)
     # Check if the file exists and is a regular file (i.e. not a socket, fifo, tty, block). Might still be a symlink.