Bug 454975

Summary: Possible to freeze NeoChat temporarily via image rendering
Product: [Applications] NeoChat Reporter: Jan Bidler <janbidler00>
Component: GeneralAssignee: Tobias Fella <fella>
Status: RESOLVED LATER    
Severity: normal CC: carl
Priority: NOR    
Version: unspecified   
Target Milestone: ---   
Platform: Other   
OS: All   
Latest Commit: Version Fixed In:
Sentry Crash Report:
Attachments: SVG which freezes neochat

Description Jan Bidler 2022-06-07 13:13:20 UTC
Created attachment 149530 [details]
SVG which freezes neochat

SUMMARY
By abusing the fact that NeoChat tries to render all images on the main thread (I assume at least) it's possible to temporarily freeze NeoChat completely by i.e. sending an svg which links to very big images.

STEPS TO REPRODUCE
1. Have someone send an svg which has references to very big (>100MB+) images in a room
2. Open the room with neochat.

OBSERVED RESULT
NeoChat becomes unresponsive and freezes for a while, while trying to render the svg.

EXPECTED RESULT
NeoChat should not freeze.

SOFTWARE/OS VERSIONS
Windows: 10 21H1
Linux: Arch Linux 
NeoChat: 22.04
KDE Frameworks Version: 5.94.0
Qt Version: 5.15.2
Comment 1 Tobias Fella 2022-11-27 18:34:20 UTC
I don't really see any potential for us to fix that unfortunately
Comment 2 Jan Bidler 2022-11-28 14:54:53 UTC
How much control do you have over the SVG rendering? Would it maybe be possible to disable the rendering of external svg assets?