| Summary: | ZIP directory traversal though document title corrupts .kra files | ||
|---|---|---|---|
| Product: | [Applications] krita | Reporter: | Nagy Tibor <xnagytibor> |
| Component: | File formats | Assignee: | Tiar <tamtamy.tymona> |
| Status: | ASSIGNED --- | ||
| Severity: | normal | CC: | halla, tamtamy.tymona |
| Priority: | NOR | ||
| Version: | 4.4.1 | ||
| Target Milestone: | --- | ||
| Platform: | Neon | ||
| OS: | Linux | ||
| Latest Commit: | Version Fixed In: | ||
| Attachments: | Observed result | ||
Yes, I can confirm this. I guess it's not a real problem in practice, but we'll have to fix it. A possibly relevant merge request was started @ https://invent.kde.org/graphics/krita/-/merge_requests/1290 |
Created attachment 133807 [details] Observed result SUMMARY Entering relative paths to the document title field corrupts .kra files on save through a ZIP directory traversal bug. KDE Ark also flags these archives as "contains ill-formed entries and might be a malicious archive". STEPS TO REPRODUCE 1. Create a new document 2. File -> Document Information -> General -> Title 3. Enter "../../../../../test/" as the document title (without quotes) 4. Save as .kra and close the document 5. Reopen the document OBSERVED RESULT See attachment. EXPECTED RESULT Don't corrupt documents on save whatever the document title is. SOFTWARE/OS VERSIONS Linux/KDE Plasma: KDE neon 5.20 KDE Plasma Version: 5.20.3 KDE Frameworks Version: 5.76.0 Qt Version: 5.15.1 ADDITIONAL INFORMATION