search

blueprint-freespeech / ricochet-refresh

Anonymous peer-to-peer instant messaging
https://www.ricochetrefresh.net
Other
224 stars 27 forks source link

Security: UI Redressing / Shared File Names can contained HTML #195

Closed s-rah closed 2 months ago

s-rah commented 2 months ago

Users can share files with names that contain a restricted subset of HTML https://doc.qt.io/qt-6/richtext-html-subset.html - this allows the remote peer some degree of control over the messaging page, including the ability to format text and links and potentially include images.

Screenshot_2024-09-20_10-14-09

Note: Image inclusion is limited because RR rejects files containing forward slashes, and by default QML assumes the URI is a qrc resource (and there are no images in the default qrc root) - however I've not done extensive testing here so I wouldn't rule out the possibility of being able to load an image using this method (locally or otherwise).

morganava commented 2 months ago

ffs

morganava commented 2 months ago

Ok at least links aren't clickable and we're doing the right thing for normal messages: image

Working on a patch, thx Sarah!

morganava commented 2 months ago

One-line fix fortunately: image Will push a new release later today.

morganava commented 2 months ago

Fixedin 498bcf90b2f50599dba1a5bfd130620a08543a0f

morganava commented 2 months ago

Fixed as of Ricochet-Refresh 3.0.27