Bug 480193 - KMail QML HTML injection via --subject and --attach
Summary: KMail QML HTML injection via --subject and --attach
Status: REPORTED
Alias: None
Product: kmail2
Classification: Applications
Component: composer (show other bugs)
Version: unspecified
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: kdepim bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-01-22 22:11 UTC by Benjamin Flesch
Modified: 2024-03-12 20:07 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Benjamin Flesch 2024-01-22 22:11:08 UTC
SUMMARY
***
HTML injection into KMail UI
afaik not security issue because external image urls are not followed
***


STEPS TO REPRODUCE
1. kmail --composer --body '' --attach '<h1>HTML Injection bf</h1><img source="https://www.spyber.com/sig-25163.png"  width="100" height="100" />'
2. kmail --composer --attach 'asdasd <h1>HTML Injection @bf</h1><img src="0" /> ' --subject '<h1>injectko</h1>asdasd'


OBSERVED RESULT
custom HTML in kmail UI and alert dialogs

EXPECTED RESULT
no custom HTML in kmail UI


SOFTWARE/OS VERSIONS
kmail2 5.24.4 (23.08.4)
Comment 1 Laurent Montel 2024-01-23 05:59:16 UTC
Git commit a10fca4cb4d16440db694a9e007186c1230eba69 by Laurent Montel.
Committed on 23/01/2024 at 06:59.
Pushed by mlaurent into branch 'release/24.02'.

Don't insert HTML in subject

M  +2    -2    src/editor/kmcomposerwin.cpp

https://invent.kde.org/pim/kmail/-/commit/a10fca4cb4d16440db694a9e007186c1230eba69
Comment 2 Laurent Montel 2024-01-23 06:01:09 UTC
Git commit 3442628448349d1f12d97a28efc397d5e08c3001 by Laurent Montel.
Committed on 23/01/2024 at 07:01.
Pushed by mlaurent into branch 'master'.

Don't insert HTML in subject

M  +2    -2    src/editor/kmcomposerwin.cpp

https://invent.kde.org/pim/kmail/-/commit/3442628448349d1f12d97a28efc397d5e08c3001
Comment 3 Laurent Montel 2024-01-23 07:04:54 UTC
For subject I fixed it.
For attachment, I don't see how I can fix it...
Comment 4 Bug Janitor Service 2024-03-12 15:18:23 UTC
A possibly relevant merge request was started @ https://invent.kde.org/frameworks/kio/-/merge_requests/1574
Comment 5 Bug Janitor Service 2024-03-12 15:23:24 UTC
A possibly relevant merge request was started @ https://invent.kde.org/pim/kmail/-/merge_requests/123
Comment 6 Carl Schwan 2024-03-12 20:06:32 UTC
Git commit d67a5362a28c1e8fbca2e115b4154c09adb6ec43 by Carl Schwan.
Committed on 12/03/2024 at 20:06.
Pushed by carlschwan into branch 'master'.

Fix HTML injection in externally added warning widget

M  +13   -2    src/editor/warningwidgets/attachmentaddedfromexternalwarning.cpp

https://invent.kde.org/pim/kmail/-/commit/d67a5362a28c1e8fbca2e115b4154c09adb6ec43
Comment 7 Carl Schwan 2024-03-12 20:07:31 UTC
Git commit f09e83b3b91637fe3b5812e50fd796b7fb78a7f6 by Carl Schwan.
Committed on 12/03/2024 at 20:07.
Pushed by carlschwan into branch 'release/24.02'.

Fix HTML injection in externally added warning widget


(cherry picked from commit d67a5362a28c1e8fbca2e115b4154c09adb6ec43)

M  +13   -2    src/editor/warningwidgets/attachmentaddedfromexternalwarning.cpp

https://invent.kde.org/pim/kmail/-/commit/f09e83b3b91637fe3b5812e50fd796b7fb78a7f6