Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security: UI Redressing / Shared File Names can contained HTML #195

Closed
s-rah opened this issue Sep 20, 2024 · 5 comments
Closed

Security: UI Redressing / Shared File Names can contained HTML #195

s-rah opened this issue Sep 20, 2024 · 5 comments
Assignees
Labels
bug Something isn't working

Comments

@s-rah
Copy link

s-rah commented Sep 20, 2024

Users can share files with names that contain a restricted subset of HTML https://doc.qt.io/qt-6/richtext-html-subset.html - this allows the remote peer some degree of control over the messaging page, including the ability to format text and links and potentially include images.

Screenshot_2024-09-20_10-14-09

Note: Image inclusion is limited because RR rejects files containing forward slashes, and by default QML assumes the URI is a qrc resource (and there are no images in the default qrc root) - however I've not done extensive testing here so I wouldn't rule out the possibility of being able to load an image using this method (locally or otherwise).

@morganava
Copy link
Collaborator

ffs

@morganava
Copy link
Collaborator

Ok at least links aren't clickable and we're doing the right thing for normal messages:
image

Working on a patch, thx Sarah!

@morganava
Copy link
Collaborator

One-line fix fortunately:
image
Will push a new release later today.

@morganava
Copy link
Collaborator

Fixedin 498bcf9

@morganava morganava self-assigned this Sep 20, 2024
@morganava morganava added the bug Something isn't working label Sep 20, 2024
@morganava
Copy link
Collaborator

Fixed as of Ricochet-Refresh 3.0.27

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants