There is a security hole in the 4.9 version of KAddressBook, more precisely a XSS Injection is possible through a malicious vcard file, when imported. Try to import the vcard http://www.securem.eu/test.vcf for example. Additionally, the label for the TEL field is not displayed on my screen (maybe a missing French translation ?). What about yours ? Reproducible: Always Steps to Reproduce: 1. Download the file http://www.securem.eu/test.vcf 2. Import it into KAddressBook 3. Show the corresponding profile "Mickaël Bergöm" Actual Results: HTML code in plaintext fields is evaluated and displayed as it Expected Results: The tags <h1> should be escaped and the "<" / ">" characters replaced by HTML Entities... Actually this hole will not compromise your computer as Javascript code seems to be disabled / iframes too, for example. But it still allows a malicious file displaying wrong things, or directing you to another website (URL field with a link to a malware website : <a href="booh.com">good.com</a>)
Which application did you use to create this vcard (to understand how you create TEL field ?)
this application missed to add type of phone. So it's normal. But perhaps we need to add default type. But need to know which apps do it.
in thunderbird TEL field is not imported because type is missing too
Oops, my fault for the TEL field, it was a hand-made vcard and I only read the Wikipedia page, I didn't know that the TYPE item was mandatory (isn't it ?) Thank you for solving this problem, however the security report is still open.
Yes I saw problem with html Will look at it.
Git commit d5bb7c20544170e06ecaaeb21c747c3b8905fc63 by Tobias Koenig. Committed on 13/10/2012 at 11:56. Pushed by tokoe into branch 'master'. Fix XSS issue in the contact viewer This was not really a security risk, since the used QTextBrowser has not way to access the network automatically, but fixing it right now makes it future-proof. M +13 -12 akonadi/contact/standardcontactformatter.cpp http://commits.kde.org/kdepimlibs/d5bb7c20544170e06ecaaeb21c747c3b8905fc63