Better check for xdg-dir access (#222)

* Better check for xdg-dir access

* Skip xdg-config/kdeglobals:ro

flatpak_builder_lint/checks/finish_args.py

@@ -1,3 +1,4 @@
+import re
 from collections import defaultdict
 from typing import Optional, Set
 
@@ -24,11 +25,16 @@ def _validate(self, appid: Optional[str], finish_args: dict[str, Set[str]]) -> N
             self.errors.add("finish-args-fallback-x11-without-wayland")
 
         for xdg_dir in ["xdg-data", "xdg-config", "xdg-cache"]:
-            if xdg_dir in finish_args["filesystem"]:
-                self.errors.add(f"finish-args-arbitrary-{xdg_dir}-access")
-
+            regexp_arbitrary = f"^{xdg_dir}(:(create|rw|ro)?)?$"
+            regexp_unnecessary = f"^{xdg_dir}(\\/.*)?(:(create|rw|ro)?)?$"
             for fs in finish_args["filesystem"]:
-                if fs.startswith(f"{xdg_dir}/") and fs.endswith(":create"):
+                # This is inherited by apps from the KDE runtime
+                if fs == "xdg-config/kdeglobals:ro":
+                    continue
+
+                if re.match(regexp_arbitrary, fs):
+                    self.errors.add(f"finish-args-arbitrary-{xdg_dir}-access")
+                elif re.match(regexp_unnecessary, fs):
                     self.errors.add(f"finish-args-unnecessary-{xdg_dir}-access")
 
         for fs in finish_args["filesystem"]:

tests/manifests/finish_args.json

@@ -5,7 +5,9 @@
         "--device=shm",
         "--filesystem=home",
         "--filesystem=host",
+        "--filesystem=xdg-cache:create",
         "--filesystem=xdg-config/autostart",
+        "--filesystem=xdg-config/kdeglobals:ro",
         "--filesystem=xdg-data",
         "--filesystem=xdg-data/foo:create",
         "--own-name=org.flathub.finish_args",

tests/test_manifest.py

@@ -61,6 +61,7 @@ def test_manifest_finish_args() -> None:
         "finish-args-arbitrary-autostart-access",
         "finish-args-arbitrary-dbus-access",
         "finish-args-arbitrary-xdg-data-access",
+        "finish-args-arbitrary-xdg-cache-access",
         "finish-args-broken-kde-tray-permission",
         "finish-args-flatpak-spawn-access",
         "finish-args-incorrect-dbus-gvfs",
@@ -88,7 +89,6 @@ def test_manifest_finish_args() -> None:
 def test_manifest_finish_args_issue_33() -> None:
     ret = run_checks("tests/manifests/own_name_substring.json")
     found_errors = set(ret["errors"])
-    print(found_errors)
     assert "finish-args-unnecessary-appid-own-name" not in found_errors
 
     ret = run_checks("tests/manifests/own_name_substring2.json")