Fix top 5 dangerous bugs (terminal raw-mode, credential overwrite, firmware cleanup, fd leak, substring check)

src/update_all/analogue_pocket/firmware_update.py

@@ -56,7 +56,7 @@ def pocket_firmware_update(curl_ssl: str, local_repository: LocalRepository, log
         firmware_name = Path(firmware).name.lower()
         if firmware_name == firmware_info['file'].lower():
             already_on_latest_firmware = True
-            break
+            continue
 
         logger.print(f'Removing old firmware file: {firmware_name}')
         os.remove(firmware)

src/update_all/arcade_organizer/arcade_organizer.py

@@ -703,11 +703,12 @@ def _remove_dir(self, directory):
 
     def _remove_broken_symlinks(self, directory):
         try:
-            for entry in os.scandir(directory):
-                if entry.is_dir(follow_symlinks=False):
-                    self._remove_broken_symlinks(entry.path)
-                elif entry.is_symlink() and not os.path.exists(entry.path):
-                    os.remove(entry.path)
+            with os.scandir(directory) as entries:
+                for entry in entries:
+                    if entry.is_dir(follow_symlinks=False):
+                        self._remove_broken_symlinks(entry.path)
+                    elif entry.is_symlink() and not os.path.exists(entry.path):
+                        os.remove(entry.path)
         except Exception as e:
             self._printer.print("Couldn't clean broken symlinks at " + directory)
             self._printer.print(str(e))

src/update_all/countdown.py

@@ -87,9 +87,16 @@ def execute_count(self, count) -> CountdownOutcome:
             time.sleep(1.0 / 60.0)
 
             child_process.terminate()
-            time.sleep(1.0 / 60.0)
-
-            child_process.close()
+            child_process.join(timeout=1.0)
+            try:
+                child_process.close()
+            except ValueError:
+                child_process.kill()
+                child_process.join(timeout=1.0)
+                try:
+                    child_process.close()
+                except ValueError:
+                    pass
             os_specifics.finalize()
             print('', flush=True)
 

src/update_all/retroaccount.py

@@ -242,10 +242,12 @@ def _build_mister_sync_transition(self) -> Optional[_SyncTransition]:
         self._logger.bench('RetroAccountService Gateway mister_sync end')
 
         if result == SessionResult.VALID and isinstance(response, dict):
-            new_user_json = response.get('tokens', None)
-            if isinstance(new_user_json, dict) and len(new_user_json) >= 1:
+            tokens = response.get('tokens', None)
+            new_user_json: Optional[dict[str, Any]] = None
+            if isinstance(tokens, dict) and len(tokens) >= 1:
                 self._logger.debug(f'RetroAccountService: New token!')
-                new_user_json['device_id'] = device_id
+                tokens['device_id'] = device_id
+                new_user_json = tokens
 
             benefits = response.get('benefits', {})
             self._logger.debug(f'RetroAccountService: Benefits after mister_sync ', benefits)

src/update_all/timeline.py

@@ -215,7 +215,7 @@ def add_doc_section(doc: list[str], section: dict[str, Any], names_dict: dict[st
 
     for category in categories:
         formatted_category = category['category']
-        if formatted_category in ('system'):
+        if formatted_category == 'system':
             formatted_category = f"{formatted_category.capitalize()} file"
         else:
             formatted_category = formatted_category.capitalize()