security: pin MASShortcut, confirm URL tasks, harden config auto-load (#1765)

Addresses three issues identified in a source-level security audit
(see SECURITY_AUDIT.md for the full report):

1. [High] MASShortcut SPM dependency was pinned to `branch = master`,
   meaning every build pulled the latest tip with no review gate. Pin
   to the current HEAD revision SHA so future upstream changes require
   an explicit bump.

2. [Medium] `rectangle://execute-task=ignore-app/unignore-app` URL
   actions silently mutated the disabled-apps defaults when triggered
   from outside Rectangle (e.g. a web page). Require an NSAlert
   confirmation, surfacing the bundle-id, unless Rectangle itself is
   frontmost.

3. [Medium] `Config.loadFromSupportDir()` silently auto-loaded any
   RectangleConfig.json dropped in Application Support on launch. Add
   a confirmation prompt, reject symlinks and world-writable files,
   and apply a 1 MiB size cap to the loader (defense against OOM via
   giant config).

Also includes SECURITY_AUDIT.md documenting the full review, including
confirmation that the app contains no telemetry, analytics, or crash
reporting and that the only outbound network channel is the
EdDSA-signed Sparkle update feed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: JakubAnderwald

Rectangle.xcodeproj/project.pbxproj

@@ -1519,8 +1519,8 @@
 			isa = XCRemoteSwiftPackageReference;
 			repositoryURL = "https://github.com/rxhanson/MASShortcut";
 			requirement = {
-				branch = master;
-				kind = branch;
+				kind = revision;
+				revision = 2f9fbb3f959b7a683c6faaf9638d22afad37a235;
 			};
 		};
 		9877B63B29C8AC3600F02D74 /* XCRemoteSwiftPackageReference "Sparkle" */ = {

Rectangle/AppDelegate.swift

@@ -644,6 +644,26 @@ extension AppDelegate {
                 return isValid
             }
 
+            func confirmExecuteTask(action: String, bundleId: String) -> Bool {
+                // Defense-in-depth: any web page or another app can trigger the
+                // `rectangle://execute-task=ignore-app` URL with an arbitrary
+                // bundle-id. Without confirmation this silently mutates
+                // Rectangle's `disabledApps` defaults. Skip the prompt only
+                // when Rectangle itself is frontmost (i.e. the user almost
+                // certainly clicked this from inside Rectangle's own UI).
+                if NSWorkspace.shared.frontmostApplication == NSRunningApplication.current {
+                    return true
+                }
+                let alert = NSAlert()
+                alert.alertStyle = .warning
+                alert.messageText = "Allow Rectangle URL action?".localized
+                alert.informativeText = String(format: "An external source asked Rectangle to perform \"%@\" on app bundle id \"%@\". Allow?".localized, action, bundleId)
+                alert.addButton(withTitle: "Allow".localized)
+                alert.addButton(withTitle: "Cancel".localized)
+                NSApp.activate(ignoringOtherApps: true)
+                return alert.runModal() == .alertFirstButtonReturn
+            }
+            
             for url in urls {
                 guard
                     let components = URLComponents(url: url, resolvingAgainstBaseURL: true),
@@ -659,11 +679,13 @@ extension AppDelegate {
                     action?.postUrl()
                 case ("execute-task", "ignore-app"):
                     let bundleId = extractBundleIdParameter(fromComponents: components)
-                    guard isValidParameter(bundleId: bundleId) else { continue }
+                    guard isValidParameter(bundleId: bundleId), let bundleId else { continue }
+                    guard confirmExecuteTask(action: "ignore-app", bundleId: bundleId) else { continue }
                     self.applicationToggle.disableApp(appBundleId: bundleId)
                 case ("execute-task", "unignore-app"):
                     let bundleId = extractBundleIdParameter(fromComponents: components)
-                    guard isValidParameter(bundleId: bundleId) else { continue }
+                    guard isValidParameter(bundleId: bundleId), let bundleId else { continue }
+                    guard confirmExecuteTask(action: "unignore-app", bundleId: bundleId) else { continue }
                     self.applicationToggle.enableApp(appBundleId: bundleId)
                 default:
                     continue

Rectangle/PrefsWindow/Config.swift

@@ -62,6 +62,13 @@ extension Defaults {
     static func load(fileUrl: URL) {
         guard let dictTransformer = ValueTransformer(forName: NSValueTransformerName(rawValue: MASDictionaryTransformerName)) else { return }
 
+        // Size cap: legitimate configs are ~tens of KB; refuse anything that
+        // looks abusive (defense against OOM via a giant config file).
+        if let attrs = try? FileManager.default.attributesOfItem(atPath: fileUrl.path),
+           let size = attrs[.size] as? NSNumber, size.intValue > 1_048_576 {
+            return
+        }
+        
         guard let jsonString = try? String(contentsOf: fileUrl, encoding: .utf8),
               let config = convert(jsonString: jsonString) else { return }
 
@@ -95,14 +102,55 @@ extension Defaults {
 
             let exists = try? configURL.checkResourceIsReachable()
             if exists == true {
+                // Defense-in-depth: any process running as this user can drop
+                // a RectangleConfig.json in Application Support and have it
+                // silently applied on next launch, overwriting shortcuts and
+                // defaults. Require the user to confirm before loading.
+                //
+                // We also refuse symlinks (could redirect reads elsewhere) and
+                // any file with world-write permission (suggests tampering).
+                let path = configURL.path
+                let fm = FileManager.default
+                var isSafe = true
+                
+                if let attrs = try? fm.attributesOfItem(atPath: path) {
+                    if (attrs[.type] as? FileAttributeType) == .typeSymbolicLink {
+                        isSafe = false
+                    }
+                    if let perms = attrs[.posixPermissions] as? NSNumber,
+                       (perms.intValue & 0o002) != 0 {
+                        isSafe = false
+                    }
+                }
+                
+                guard isSafe else {
+                    AlertUtil.oneButtonAlert(
+                        question: "Refused to load RectangleConfig.json",
+                        text: "The configuration file at \(path) is a symlink or world-writable. Rectangle has refused to load it. Remove the file or fix its permissions and try again."
+                    )
+                    try? fm.removeItem(at: configURL)
+                    return
+                }
+                
+                let response = AlertUtil.twoButtonAlert(
+                    question: "Apply Rectangle configuration?",
+                    text: "A configuration file was found at \(path). Applying it will overwrite your current Rectangle shortcuts and preferences. Apply now?",
+                    confirmText: "Apply",
+                    cancelText: "Discard"
+                )
+                guard response == .alertFirstButtonReturn else {
+                    try? fm.removeItem(at: configURL)
+                    return
+                }
+                
                 load(fileUrl: configURL)
                 do {
                     let newFilename = "RectangleConfig\(timestamp()).json"
 
-                    try FileManager.default.moveItem(atPath: configURL.path, toPath: rectangleSupportURL.appendingPathComponent(newFilename).path)
+                    try fm.moveItem(atPath: configURL.path, toPath: rectangleSupportURL.appendingPathComponent(newFilename).path)
                 } catch {
                     do {
-                        try FileManager.default.removeItem(at: configURL)
+                        try fm.removeItem(at: configURL)
                     } catch {
                         AlertUtil.oneButtonAlert(question: "Error after loading from Support Dir", text: "Unable to rename/remove RectangleConfig.json from \(rectangleSupportURL) after loading.")
                     }