Bug 374749 - privacy leak in search debug output
Summary: privacy leak in search debug output
Status: RESOLVED FIXED
Alias: None
Product: kmail2
Classification: Applications
Component: search (show other bugs)
Version: 5.2.3
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: kdepim bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-01-08 12:41 UTC by Martin Steigerwald
Modified: 2017-01-09 16:14 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments
kdebugsettings akonadi (99.45 KB, image/png)
2017-01-09 09:48 UTC, Martin Steigerwald
Details
kdebugsettings kmail (47.63 KB, image/png)
2017-01-09 09:49 UTC, Martin Steigerwald
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Steigerwald 2017-01-08 12:41:20 UTC
This debug output might be done by some Akonadi component. Feel free to reassign. Akonadi and KDEPIM is 16.04.3 from Debian Unstable packages (Debian unfortunately has no newer packages due to difficultity / time constraints regarding packaging Qt Webengine which is needed for newer KDEPIM versions).

After starting KMail on command line it outputs search debug messages which reveal the exact search query including the mail address being searched for.


# How to reproduce
- Start kmail on console

You may need to do a search, but on my system it automatically does this one search on startup, querying whatever mail item is highlighted after start of KMail.


# Actual results

When starting KMail via desktop session this goes to ~/.xsession-errors and/or systemd-journald user session login and thus leaks private information to log files.

Debug output is disabled globally in kdebugdialog, which I learnt before may not yet used anymore.

Executing search "searchUpdate-1483877954"
searchUpdateResultsAvailable 396 0 results
Got 0 results, out of which 0 are already in the collection
Added 0
Search done "searchUpdate-1483877954" (without remote search)
Search update finished
All results: 0
Removed results: 0
Executing search "searchUpdate-1483877954"
searchUpdateResultsAvailable 395 0 results
Got 0 results, out of which 0 are already in the collection
Added 0
Search done "searchUpdate-1483877954" (without remote search)
Search update finished
All results: 0
Removed results: 0
posting retrieval request for item 3013668  there are  1  queues and  0  items in mine
request for item 3013668 still pending - waiting
processing retrieval request for item 3013668  parts: ("RFC822", "HEAD")  of resource: "akonadi_maildir_resource_0"
continuing
request for item 3013668 succeeded
Database "akonadi" opened using driver "QMYSQL"
SEARCH:
        Query: "{\n    \"limit\": -1,\n    \"negated\": false,\n    \"rel\": 1,\n    \"subTerms\": [\n        {\n            \"cond\": 0,\n            \"key\": \"email\",\n            \"negated\": false,\n            \"value\": \"bugzilla_noreply@kde.org\"\n        }\n    ]\n}\n"
        MimeTypes: ("text/directory")
        Collections: QVector(0, 276)
        Remote: false
        Recursive true
Executing search "kmail2-1186278907-SearchSession"
Search done "kmail2-1186278907-SearchSession" (without remote search)
        Result: 0 matches
SEARCH:
        Query: "{\n    \"limit\": -1,\n    \"negated\": false,\n    \"rel\": 1,\n    \"subTerms\": [\n        {\n            \"cond\": 0,\n            \"key\": \"email\",\n            \"negated\": false,\n            \"value\": \"bugzilla_noreply@kde.org\"\n        }\n    ]\n}\n"
        MimeTypes: ("text/directory")
        Collections: QVector(0, 276)
        Remote: false
        Recursive true
Executing search "kmail2-1186278907-SearchSession"
Search done "kmail2-1186278907-SearchSession" (without remote search)
        Result: 0 matches
Executing search "searchUpdate-1483877969"
searchUpdateResultsAvailable 396 0 results
Got 0 results, out of which 0 are already in the collection
Added 0
Search done "searchUpdate-1483877969" (without remote search)
Search update finished
All results: 0
Removed results: 0
Executing search "searchUpdate-1483877969"
searchUpdateResultsAvailable 395 0 results
Got 0 results, out of which 0 are already in the collection
Added 0
Search done "searchUpdate-1483877969" (without remote search)
Search update finished
All results: 0
Removed results: 0


# Expected results
No debug output which leaks privacy sensitive information in production builds. Preferably no debug output at all unless manually enabled. Ideally also sanitize optionally switchable debug output which are intended to be included in bug reports.
Comment 1 Laurent Montel 2017-01-09 05:50:30 UTC
For kf5 you need to use kdebugsettings and not kdebugdialog.
When you disable all settings you disable theses debugs too.
it use debug categories feature.
Comment 2 Martin Steigerwald 2017-01-09 09:47:41 UTC
Laurent, thank you. I installed kdebugsettings 16.08.3-1 debian package, disabled all debug, logged out of the session, made sure all processes of the user are gone, logged in to the session, checked whether kdebugsettings still shows off for all the applications and then start kmail.

And I still get these – thus reopening:

posting retrieval request for item 3016005  there are  1  queues and  0  items in mine
request for item 3016005 still pending - waiting
processing retrieval request for item 3016005  parts: ("RFC822")  of resource: "akonadi_maildir_resource_0"
continuing
request for item 3016005 succeeded
SEARCH:
        Query: "{\n    \"limit\": -1,\n    \"negated\": false,\n    \"rel\": 1,\n    \"subTerms\": [\n        {\n            \"cond\": 0,\n            \"key\": \"email\",\n            \"negated\": false,\n            \"value\": \"bugzilla_noreply@kde.org\"\n        }\n    ]\n}\n"
        MimeTypes: ("text/directory")
        Collections: QVector(0, 276)
        Remote: false
        Recursive true
Executing search "kmail2-1186278907-SearchSession"
Search done "kmail2-1186278907-SearchSession" (without remote search)
        Result: 0 matches
SEARCH:
        Query: "{\n    \"limit\": -1,\n    \"negated\": false,\n    \"rel\": 1,\n    \"subTerms\": [\n        {\n            \"cond\": 0,\n            \"key\": \"email\",\n            \"negated\": false,\n            \"value\": \"bugzilla_noreply@kde.org\"\n        }\n    ]\n}\n"
        MimeTypes: ("text/directory")
        Collections: QVector(0, 276)
        Remote: false
        Recursive true
Executing search "kmail2-1186278907-SearchSession"
Search done "kmail2-1186278907-SearchSession" (without remote search)
        Result: 0 matches
Comment 3 Martin Steigerwald 2017-01-09 09:48:16 UTC
Created attachment 103301 [details]
kdebugsettings akonadi
Comment 4 Martin Steigerwald 2017-01-09 09:49:15 UTC
Created attachment 103302 [details]
kdebugsettings kmail

I really clicked on "Turn Off Debug" which turned off all applications. So also debug output for applications not listed as KMail or Akonadi are turned off.
Comment 5 Laurent Montel 2017-01-09 13:20:11 UTC
did you restart akonadi/kmail ?:)
Comment 6 Martin Steigerwald 2017-01-09 15:05:48 UTC
Laurent, as I wrote I logged out from the user session, made sure that all processes of the user are gone, and then logged in again. So yes, that should quality as a restart of Akonadi and KMail.
Comment 7 Laurent Montel 2017-01-09 16:14:40 UTC
so 5.2.3 didn't use qCDebug and co :)
You need to update to new version as it works fine.