[jeromelefeuvre]

Checklist

• I've read the publishing documentation.
• I've added the HACS action to my repository.
• (For integrations only) I've added the hassfest action to my repository.
• The actions are passing without any disabled checks in my repository.
• I've added a link to the action run on my repository below in the links section.
• I've created a new release of the repository after the validation actions were run successfully.

Links

Link to current release: https://github.com/jeromelefeuvre/ha-disk-usage-explorer/releases/tag/v0.3.3
Link to successful HACS action (without the ignore key): https://github.com/jeromelefeuvre/ha-disk-usage-explorer/actions/runs/41948848607/job/126987697036
Link to successful hassfest action (if integration): https://github.com/jeromelefeuvre/ha-disk-usage-explorer/actions/runs/41948848607/job/126987697345

Disk Usage Explorer is an integration with a bundled dashboard card: it scans a folder in read-only mode and shows disk usage as an interactive donut chart.

🤖 Generated with Claude Code

[frenck]

Hi @jeromelefeuvre, thanks for the submission! 👋

One thing needs to change before this can go in.

1. The scan, cancel, browse and suggest_directories services are registered with hass.services.async_register in custom_components/disk_usage_explorer/__init__.py (lines 65 to 85), so any logged-in Home Assistant user can call them, admin or not. browse returns the full file and folder tree (names and sizes) below the configured roots and suggest_directories lists subfolders. The roots default to /media and /config (config_flow.py line 15) and are only checked as "existing absolute directory" (config_flow.py lines 52 to 64), not against hass.config.is_allowed_path. A non-admin user can therefore map everything in the config directory. Please do one of these:
   • register the four services with homeassistant.helpers.service.async_register_admin_service (it accepts supports_response), or
   • check every configured root in the config flow and every requested path in _resolve_scan_path with hass.config.is_allowed_path, and drop /config from the default.

Once that is addressed, push a new release and re-request review.

../Frenck

                       

Blogging my personal ramblings at frenck.dev
Or subscribe to my free bi-weekly newsletter: frenck.dev/newsletter

[jeromelefeuvre]

Thanks for the review! Addressed in v0.3.2 (commit):

• scan, cancel, browse and suggest_directories are now registered with async_register_admin_service, so non-admin users get Unauthorized.
• /config is no longer in the default roots; the config flow suggests only /media.
• The card shows a notice instead of the path field to non-admin users, and the README warns about allowing /config.

I updated the release and action links in the description.

🤖 Generated with Claude Code

[jeromelefeuvre]

While you review, I ran a security pass of my own and released v0.3.3:

• The status sensor no longer exposes the scanned path, warnings or full error message, since entity states are readable by non-admin users. browse (admin only) returns them instead.
• Each folder is opened with O_NOFOLLOW and checked against the device and inode seen when listed, so a folder swapped for a symlink mid-scan is skipped.

The description links point to v0.3.3.

🤖 Generated with Claude Code

[frenck]

Hi @jeromelefeuvre, thanks for the quick turnaround on the admin-only services, that earlier ask is settled in v0.3.3.

One thing is left. DiskScanner.__init__ in custom_components/disk_usage_explorer/scanner.py (line 88) calls Path(root).resolve() for every configured root, and async_setup_entry in custom_components/disk_usage_explorer/__init__.py (line 96) builds the scanner directly on the event loop. Path.resolve() walks the path with filesystem calls, so on slow or network-mounted storage (a NAS share under /media, for example) setup stalls the whole event loop, blocking every other integration. The roots are already resolved and validated in _validate_roots in the config flow, so you can drop the .resolve() in __init__ and use Path(root). If you prefer to keep a second resolve as a safety net, do it in the executor with await hass.async_add_executor_job(...) before creating the scanner.

Once that is addressed, push a new release and re-request review.

../Frenck

                       

Blogging my personal ramblings at frenck.dev
Or subscribe to my free bi-weekly newsletter: frenck.dev/newsletter