reckless: store source locations as correct type
What the developer wrote
Authored by Alex Myers
reckless: store source locations as correct type
What changed, and why it matters
This commit fixes three places in the 'reckless' plugin-installer tool where a file path was stored as a Path object instead of as a plain string. The fix converts the path to a string before assigning it. This is a type-correctness bug that could cause crashes or unexpected behavior when the value is later used as a string, but it is not a direct security vulnerability and there is no evidence it is exploitable for code execution or privilege escalation.
No urgent security action required. Treat as a normal code-quality/robustness fix. If auditing, verify that all consumers of source_loc handle strings consistently and that no Path object could reach a shell command or unsafe path operation.
Security signals we found
Type mismatch between pathlib.Path and str in source location field
Potential runtime TypeError in string-context usage of source_loc
Fix is in a plugin installer/management tool (reckless), which has elevated filesystem interaction
Evidence from the diff
The patch changes three assignments in tools/reckless so that self.source_loc / source.source_loc / cloned_src.source_loc are assigned str(…) of a pathlib.Path rather than the Path object itself. The field is evidently intended to hold a string (e.g., used for logging, path comparisons, or serialization). Passing a Path where a string is expected can raise TypeError in string operations, formatting, or downstream functions. The change is defensive and improves robustness of the reckless plugin manager, but the diff alone does not demonstrate a security-relevant failure mode.
Changed components
tools/recklessInstInfo.source_loc_source_search()_install_plugin()Inspect captured patch +3 / −3
diff --git a/tools/reckless b/tools/reckless
index 5dba0daa..bf03354f 100755
--- a/tools/reckless
+++ b/tools/reckless
@@ -312,7 +312,7 @@ class InstInfo:
return False
log.debug(f"falling back to cloning remote repo {self}")
# Update to reflect use of a local clone
- self.source_loc = target.location
+ self.source_loc = str(target.location)
self.srctype = target.srctype
result = search_dir(self, target, False, 5)
@@ -1135,7 +1135,7 @@ def _source_search(name: str, src: str) -> Union[InstInfo, None]:
if _git_update(source, local_clone_location):
log.debug(f"Using local clone of {src}: "
f"{local_clone_location}")
- source.source_loc = local_clone_location
+ source.source_loc = str(local_clone_location)
source.srctype = Source.GIT_LOCAL_CLONE
if source.get_inst_details():
@@ -1341,7 +1341,7 @@ def _install_plugin(src: InstInfo) -> Union[InstInfo, None]:
if not cloned_src.entry:
# The plugin entrypoint may not be discernable prior to cloning.
# Need to search the newly cloned directory, not the original
- cloned_src.source_loc = plugin_path
+ cloned_src.source_loc = str(plugin_path)
# Relocate plugin to a staging directory prior to testing
if not Path(inst_path).exists():
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.