Escape application names for GMarkup #51
Conversation
|
(pylint complains) |
GLib provides a parser called GMarkup, which implements a subset of XML. Application names may contain XML metacharacters, such as "<" and "&". These must be escaped to prevent XML injection, but the app menu didn't do that. The GMarkup documentation explicitly states that GMarkup must not be used to parse untrusted input [1]. Therefore, parsing malicious markup may have undefined results. Fortunately, there is no security problem because the only allowed character with special meaning in XML is "&" and ";" is not allowed. Therefore, there is no way to create a valid XML entity or inject tags. The worst that can happen is the creation of ill-formed markup that that GLib rejects. This patch also addresses a URL construction bug: filenames need to be URL-encoded in file:// URLs. [1]: https://github.com/GNOME/glib/blob/3304a517d9a7bdbb52d60394fdae6f9903f0f4f3/glib/gmarkup.c#L50-L51
OpenQA test summaryComplete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2024121004-4.3&flavor=pull-requests Test run included the following:
New failures, excluding unstableCompared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2024111705-4.3&flavor=update
Failed tests4 failures
Fixed failuresCompared to: https://openqa.qubes-os.org/tests/119126#dependencies 2 fixed
Unstable tests
|
DemiMarie
force-pushed
the
fix-markup-error
branch
from
feccd44 to
b2e036c
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #51 +/- ##
==========================================
- Coverage 83.01% 82.24% -0.77%
==========================================
Files 22 22
Lines 2190 2349 +159
==========================================
+ Hits 1818 1932 +114
- Misses 372 417 +45 ☔ View full report in Codecov by Sentry. |
GLib provides a parser called GMarkup, which implements a subset of XML. Application names may contain XML metacharacters, such as "<" and "&". These must be escaped to prevent XML injection, but the app menu didn't do that.
The GMarkup documentation explicitly states that GMarkup must not be used to parse untrusted input 1. Therefore, parsing malicious markup may have undefined results. Fortunately, there is no security problem because the only allowed character with special meaning in XML is "&" and ";" is not allowed. Therefore, there is no way to create a valid XML entity or inject tags. The worst that can happen is the creation of ill-formed markup that that GLib rejects.
This patch also addresses a URL construction bug: filenames need to be URL-encoded in file:// URLs.