owncloud / client

🖥️ Desktop Syncing Client for ownCloud
GNU General Public License v2.0
1.4k stars 665 forks source link

[QA] log lines are silently exposed via crash reporter #8955

Closed jnweiger closed 3 years ago

jnweiger commented 3 years ago

Seen with client 2.9.0-beta3 on win10 while examining e.g. https://sentry.io/organizations/owncloud/issues/2604534440/events/090ac097fd434c719a989cf869e2ce86/?project=79001&statsPeriod=14d#extra

As per #8467 the crash report now contains 20 lines of log file contents. This may expose server and user names involved, sensitive filenames, or possibly credentials. The user is not informed that such data is included in the crash report. The user sees an empty text area when approving that the crash report should be sent.

Expected behaviour: The user can opt out or even better manually edit the log contents before sending.

TheOneRing commented 3 years ago

It is not silently exposed its the comment field....

TheOneRing commented 3 years ago

See https://github.com/owncloud/client/pull/8469

michaelstingl commented 3 years ago

See #8469

I didn't see content with the synthetic crash via owncloud --debug.

TheOneRing commented 3 years ago

You'd need to crash with the "enforce" or "qFatal" crash

michaelstingl commented 3 years ago

Yeah. looks good now 👍

CleanShot 2021-08-27 at 11 19 25