search

open-eid / DigiDoc4-Client

DigiDoc4 Client is an application for digitally signing and encrypting documents; the software includes functionality to manage Estonian ID-card - change pin codes etc.
https://www.id.ee/en/article/install-id-software/
Other
119 stars 43 forks source link

Application cannot start due to the "Block Untrusted Fonts" Group Policy setting. #1283

Closed ARGYROU-MINAS closed 1 day ago

ARGYROU-MINAS commented 2 weeks ago

There is an (Enterprise) Group Policy setting on Windows to "Block untrusted fonts".

Due to that, the module "Qt6Core.dll" cannot be loaded to "qdigidoc4.exe" (as evidenced by the logs in Windows Event Viewer) because of this Exploit Protection.

ARGYROU-MINAS commented 2 weeks ago

The workaround for this issue (for the application to be able to start) is to go to "Windows Security > App & browser control > Exploit protection settings > Program settings" and manually add an exception for "qdigidoc4.exe" for the "Block untrusted fonts option".

metsma commented 2 weeks ago

https://techcommunity.microsoft.com/t5/microsoft-security-baselines/dropping-the-quot-untrusted-font-blocking-quot-setting/ba-p/701068

With GDI font parsing performed in a restrictive AppContainer, the risk of handling untrusted fonts in GDI is now acceptably low enough that we feel confident that the costs of font-blocking exceed its benefits. Therefore, we are removing our previous recommendation to enable untrusted font blocking.

https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/block-untrusted-fonts-in-enterprise#view-the-event-log

And we have observed that problematic are Microsoft own fonts

FontType: File FontPath: \??\C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\EQUATION\MTEXTRA.TTF Blocked: true

kristelmerilain commented 1 day ago

Closing due inactivity, reopen if needed.