From 1c2871c6322302093449911b5c60b80677ef16f1 Mon Sep 17 00:00:00 2001
From: PhiliPdB <phlpdbrn@gmail.com>
Date: Fri, 31 Jul 2026 21:23:04 +0200
Subject: [PATCH] rapidraw: fix CVE-2026-64816

See #547735

The patch to fix this CVE (https://github.com/CyberTimon/RapidRAW/commit/83852f36ba4a260beec45b9420ca3caed2542640)
could not be applied directly, hence I backported it to v1.5.8 and
included the patch file here.

Not a cherry pick because unstable could update to the latest version.
The release-branch can't anymore due to a rust version mismatch.
---
 .../ra/rapidraw/fix-cve-2026-64816.patch      | 32 +++++++++++++++++++
 pkgs/by-name/ra/rapidraw/package.nix          |  5 +++
 2 files changed, 37 insertions(+)
 create mode 100644 pkgs/by-name/ra/rapidraw/fix-cve-2026-64816.patch

diff --git a/pkgs/by-name/ra/rapidraw/fix-cve-2026-64816.patch b/pkgs/by-name/ra/rapidraw/fix-cve-2026-64816.patch
new file mode 100644
index 000000000000..76e57ae84f53
--- /dev/null
+++ b/pkgs/by-name/ra/rapidraw/fix-cve-2026-64816.patch
@@ -0,0 +1,32 @@
+diff --git a/src-tauri/src/lut_processing.rs b/src-tauri/src/lut_processing.rs
+index 5bfbb5b9..51db4bab 100644
+--- a/src-tauri/src/lut_processing.rs
++++ b/src-tauri/src/lut_processing.rs
+@@ -187,6 +187,26 @@ fn parse_hald(image: DynamicImage) -> Result<Lut> {
+ }
+ 
+ pub fn parse_lut_file(path_str: &str) -> Result<Lut> {
++    if path_str.starts_with(r"\\") || path_str.starts_with("//") {
++        return Err(anyhow!("Network paths (UNC) are not allowed for LUTs"));
++    }
++
++    if path_str.contains("..") {
++        return Err(anyhow!("Directory traversal (..) is not allowed"));
++    }
++
++    let path = std::path::Path::new(path_str);
++    if let Some(std::path::Component::Prefix(prefix)) = path.components().next() {
++        match prefix.kind() {
++            std::path::Prefix::UNC(_, _)
++            | std::path::Prefix::VerbatimUNC(_, _)
++            | std::path::Prefix::DeviceNS(_) => {
++                return Err(anyhow!("Device/UNC prefix paths are not allowed"));
++            }
++            _ => {}
++        }
++    }
++
+     let (extension, bytes): (String, Option<Vec<u8>>) =
+         if cfg!(target_os = "android") && is_android_content_uri(path_str) {
+             #[cfg(target_os = "android")]
+
diff --git a/pkgs/by-name/ra/rapidraw/package.nix b/pkgs/by-name/ra/rapidraw/package.nix
index b5028b7c7a56..0a17e24b9def 100644
--- a/pkgs/by-name/ra/rapidraw/package.nix
+++ b/pkgs/by-name/ra/rapidraw/package.nix
@@ -58,6 +58,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-JtkzeCt21KIEshvoCHWo1QoxUgvVJN1loJrUHgvV4qE=";
   };
 
+  patches = [
+    # Patch CVE-2026-64816
+    ./fix-cve-2026-64816.patch
+  ];
+
   nativeBuildInputs = [
     pkg-config
     makeWrapper