From 12f5fb1f9d94c2b33a61e148b99ecfb849dc0659 Mon Sep 17 00:00:00 2001
From: Anthony Ronning <101225832+AnthonyRonning@users.noreply.github.com>
Date: Tue, 10 Nov 2026 13:59:21 -0800
Subject: [PATCH] Backport GLib D-Bus introspection parser fix for Linux
 desktop

---
 ...ib-dbus-introspection-cve-2026-58016.patch | 56 +++++++++++++++++++
 flake.nix                                     | 11 ++++
 2 files changed, 67 insertions(+)
 create mode 100644 apps/maple-research/frontend/src-tauri/patches/glib-dbus-introspection-cve-2026-58016.patch

diff --git a/apps/maple-research/frontend/src-tauri/patches/glib-dbus-introspection-cve-2026-58016.patch b/apps/maple-research/frontend/src-tauri/patches/glib-dbus-introspection-cve-2026-58016.patch
new file mode 100644
index 000000000..adc3e5cf2
--- /dev/null
+++ b/apps/maple-research/frontend/src-tauri/patches/glib-dbus-introspection-cve-2026-58016.patch
@@ -0,0 +1,56 @@
+From c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2 Mon Sep 17 00:00:00 2001
+From: Philip Withnall <pwithnall@gnome.org>
+Subject: [PATCH] Backport D-Bus introspection node nesting fix
+
+Upstream commit: https://github.com/GNOME/glib/commit/c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2
+Fixes: CVE-2026-58016
+
+The upstream parser fix and regression vectors are unchanged. The test
+registration path is adapted to GLib 2.88.3's existing test names.
+---
+diff --git a/gio/gdbusintrospection.c b/gio/gdbusintrospection.c
+index df5daa32..78a63e2a 100644
+--- a/gio/gdbusintrospection.c
++++ b/gio/gdbusintrospection.c
+@@ -1261 +1261 @@ parser_start_element (GMarkupParseContext  *context,
+-      if (!(g_slist_length (stack) >= 1 || strcmp (stack->next->data, "node") != 0))
++      if (stack->next != NULL && strcmp (stack->next->data, "node") != 0)
+diff --git a/gio/tests/gdbus-introspection.c b/gio/tests/gdbus-introspection.c
+index cb99c941..fccdcff5 100644
+--- a/gio/tests/gdbus-introspection.c
++++ b/gio/tests/gdbus-introspection.c
+@@ -302,0 +303,32 @@ test_extra_data (void)
++static void
++test_invalid (void)
++{
++  const struct
++    {
++      const char *xml;
++      GMarkupError expected_error_code;
++    }
++  vectors[] =
++    {
++      { "", G_MARKUP_ERROR_EMPTY },
++      { "<node><interface name=\"I\"><method name=\"M\"><node><interface name=\"I2\"></interface></node></method>", G_MARKUP_ERROR_INVALID_CONTENT },
++      { "<node><interface name=\"I\"><signal name=\"S\"><node><interface name=\"I2\"><signal name=\"S2\"></signal></interface></node></signal>", G_MARKUP_ERROR_INVALID_CONTENT },
++      { "<node><interface name=\"I\"><property name=\"P\" type=\"s\" access=\"read\"><node><interface name=\"I2\"></interface></node></property>", G_MARKUP_ERROR_INVALID_CONTENT },
++      { "<node><interface name=\"I\"><method name=\"M\"><arg type=\"\"><node><interface name=\"I2\"><method name=\"M2\"></method></interface></node></arg>", G_MARKUP_ERROR_INVALID_CONTENT },
++    };
++
++  for (size_t i = 0; i < G_N_ELEMENTS (vectors); i++)
++    {
++      GDBusNodeInfo *node;
++      GError *local_error = NULL;
++
++      g_test_message ("Testing parsing of %s gives an error", vectors[i].xml);
++
++      node = g_dbus_node_info_new_for_xml (vectors[i].xml, &local_error);
++      g_assert_error (local_error, G_MARKUP_ERROR, (int) vectors[i].expected_error_code);
++      g_assert_null (node);
++
++      g_clear_error (&local_error);
++    }
++}
++
+@@ -319,0 +352 @@ main (int   argc,
++  g_test_add_func ("/gdbus/introspection-invalid", test_invalid);
diff --git a/flake.nix b/flake.nix
index 376a361c0..628aaed5a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -21,6 +21,17 @@
         overlays = [
           (import rust-overlay)
           (final: prev: {
+            # Backport GNOME/glib@c9da977c for the Linux desktop bundle.
+            # Remove this when the pinned nixpkgs GLib changes to a fixed build.
+            glib =
+              if prev.stdenv.hostPlatform.isLinux && prev.glib.version == "2.88.3" then
+                prev.glib.overrideAttrs (old: {
+                  patches = (old.patches or [ ]) ++ [
+                    ./apps/maple-research/frontend/src-tauri/patches/glib-dbus-introspection-cve-2026-58016.patch
+                  ];
+                })
+              else
+                prev.glib;
             # Keep bun on versions.bun (and setup-bun's Windows pin) when nixpkgs moves ahead.
             bun = prev.bun.overrideAttrs (old: rec {
               version = versions.bun;