Bug 312812 - The rename dialog should show the file name as plain text
Summary: The rename dialog should show the file name as plain text
Status: RESOLVED FIXED
Alias: None
Product: dolphin
Classification: Unclassified
Component: view-engine: general (show other bugs)
Version: 2.0
Platform: Debian testing Linux
: NOR normal (vote)
Target Milestone: ---
Assignee: Dolphin Bug Assignee
URL:
Keywords: junior-jobs, reproducible
: 336729 342278 (view as bug list)
Depends on:
Blocks:
 
Reported: 2013-01-07 11:47 UTC by Suniobo
Modified: 2014-12-28 21:41 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In: 4.10


Attachments
Demonstration of HTML markup (75.62 KB, image/png)
2013-01-07 11:48 UTC, Suniobo
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Suniobo 2013-01-07 11:47:31 UTC
Reproducible: Always

Steps to Reproduce:
1. Create file with name "><hr><h1>123.txt
2. Try to rename it
Actual Results:  
See HTML markup in rename dialog

Expected Results:  
We should not see any HTML here. Need to show file name as plain text.

http://owasp.com/index.php/XSS
Comment 1 Suniobo 2013-01-07 11:48:36 UTC
Created attachment 76271 [details]
Demonstration of HTML markup
Comment 2 Frank Reininghaus 2013-01-07 12:27:57 UTC
Thanks for the bug report. I agree that this should be fixed, but I fail to see why this is a security bug.

Note: In Dolphin >= 2.1, one has to disable inline renaming to reproduce the bug.
Comment 3 Suniobo 2013-01-07 13:59:21 UTC
> Thanks for the bug report. I agree that this should be fixed, but I fail to
> see why this is a security bug.
Frank, I don't exactly know if is possible to run arbitrary JavaScript through it. For example, if instead of HTML payload will consist of some piece of JavaScript.
Comment 4 Frank Reininghaus 2013-01-07 16:27:32 UTC
(In reply to comment #3)
> Frank, I don't exactly know if is possible to run arbitrary JavaScript
> through it.

I seriously doubt that a simple label will execute Javascript code, but feel free to try it and prove me wrong ;-)
Comment 5 Emmanuel Pescosta 2013-01-07 22:03:20 UTC
(In reply to comment #0)
> Reproducible: Always
> 
> Steps to Reproduce:
> 1. Create file with name "><hr><h1>123.txt
> 2. Try to rename it
> Actual Results:  
> See HTML markup in rename dialog

This bug is also valid for the metadata widget. (KDE 4.9.5) - Is it fixed in nepomuk-widgets?
Comment 6 Emmanuel Pescosta 2013-01-07 22:19:54 UTC
(In reply to comment #3)
> > Thanks for the bug report. I agree that this should be fixed, but I fail to
> > see why this is a security bug.
> Frank, I don't exactly know if is possible to run arbitrary JavaScript
> through it. For example, if instead of HTML payload will consist of some
> piece of JavaScript.

<a href="javascript:alert('evil js!')">click me</a>

The popup doesn't appear when I click on the link (also tested with other javascript snippets) ... so I think, that the QLabel only parses html content, but doesn't execute js code. -> No file name XSS in Dolphin ;) Please correct me if I am wrong.
Comment 7 Suniobo 2013-01-08 08:48:48 UTC
(In reply to comment #6)
> (In reply to comment #3)
> > > Thanks for the bug report. I agree that this should be fixed, but I fail to
> > > see why this is a security bug.
> > Frank, I don't exactly know if is possible to run arbitrary JavaScript
> > through it. For example, if instead of HTML payload will consist of some
> > piece of JavaScript.
> 
> <a href="javascript:alert('evil js!')">click me</a>
> 
> The popup doesn't appear when I click on the link (also tested with other
> javascript snippets) ... so I think, that the QLabel only parses html
> content, but doesn't execute js code. -> No file name XSS in Dolphin ;)
> Please correct me if I am wrong.
Emmanuel, yes, looks like only pure HTML parsing exists. Furthermore it is not possible to render e.g. image.
Comment 8 Emmanuel Pescosta 2013-01-09 15:20:45 UTC
Git commit 4e6d2d849a272fd0858b9f070659576b6af44827 by Emmanuel Pescosta.
Committed on 09/01/2013 at 16:17.
Pushed by emmanuelp into branch 'KDE/4.10'.

Show the file name as plain text in the rename dialog
Related: bug 262464
FIXED-IN: 4.10
REVIEW: 108291

M  +1    -0    dolphin/src/views/renamedialog.cpp

http://commits.kde.org/kde-baseapps/4e6d2d849a272fd0858b9f070659576b6af44827
Comment 9 Frank Reininghaus 2014-06-25 21:37:55 UTC
*** Bug 336729 has been marked as a duplicate of this bug. ***
Comment 10 Frank Reininghaus 2014-12-28 21:41:07 UTC
*** Bug 342278 has been marked as a duplicate of this bug. ***