Bug 453539 - KWin scripts can set an arbitrary/invalid window geometry
Summary: KWin scripts can set an arbitrary/invalid window geometry
Status: CONFIRMED
Alias: None
Product: kwin
Classification: Plasma
Component: scripting (show other bugs)
Version: 5.24.5
Platform: Arch Linux Linux
: NOR minor
Target Milestone: ---
Assignee: KWin default assignee
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-05-08 12:57 UTC by Flupp
Modified: 2022-08-10 09:12 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Flupp 2022-05-08 12:57:52 UTC
KWin scripts can set arbitrary window geometries, e.g., a geometry completely outside of the visible screen area, but also invalid ones, e.g., negative width or height. The latter can lead to two kinds of problems:

1. The title bar gets still rendered, however, KWin’s repainting gets confused leaving behind artifacts of the window when it is moved.
2. The application owning the window might crash.

For 1., start a single instance of KWrite, position it in a way so you can remember the position of the title bar, and execute the following snippet in `plasma-interactiveconsole --kwin`:

	var clients = workspace.clientList();
	var found = false;
	for (var i = 0; i < clients.length; i++) {
		var c = clients[i];
		print(c.caption);
		if (c.caption == 'Untitled — KWrite') {
			c.geometry = {x: 100, y: 100, width: 500, height: -100};
			found = true;
			break;
		}
	}
	if (!found) print ("not found")

The title bar will now be rendered at `geometry.x`, `geometry.y`. You can move it by starting dragging at the old (and hopefully remembered) position of the title bar. (Hence, you might have to click outside of the rendered title bar. You might trigger an invisible menu or tool bar entry if you do not hit the old title bar position precisely.) When it is moved, moving upwards leaves behind a trail of old title bar artifacts. Activating the “Show Paint” KWin effect raises the suspicion that KWin interprets the negative height literally and repaints the area *above* `geometry.y`.

For 2., change the geometry in the above snippet to

			c.geometry = {x: 100, y: 100, width: -100, height: -100};

This crashes KWrite. This happens similarly for Kate but also non-Qt applications like Evolution (after adapting the matched caption in the snippet). It is not clear to me if these are bugs in the applications or used libraries or if KWin violates an API invariant the applications/libraries rely on.

Bug 315855 might be related.