diff options
| author | Florian Bruhin <git@the-compiler.org> | 2018-07-09 23:38:47 +0200 |
|---|---|---|
| committer | Florian Bruhin <git@the-compiler.org> | 2018-07-11 17:07:59 +0200 |
| commit | c2ff32d92ba9bf40ff53498ee04a4124d4993c85 (patch) | |
| tree | aa8130a54e7ea9b58f2b4192954deff26fd97d12 /tests/unit/browser/webkit/network/test_filescheme.py | |
| parent | 718f73be2eb062f4893a463bca34c18feeded251 (diff) | |
| download | qutebrowser-v1.3.x.tar.gz qutebrowser-v1.3.x.zip | |
CVE-2018-10895: Fix CSRF issues with qute://settings/set URLv1.3.x
In ffc29ee043ae7336d9b9dcc029a05bf7a3f994e8 (part of v1.0.0), a
qute://settings/set URL was added to change settings.
Contrary to what I apparently believed at the time, it *is* possible for
websites to access `qute://*` URLs (i.e., neither QtWebKit nor QtWebEngine
prohibit such requests, other than the usual cross-origin rules).
In other words, this means a website can e.g. have an `<img>` tag which loads a
`qute://settings/set` URL, which then sets `editor.command` to a bash script.
The result of that is arbitrary code execution.
Fixes #4060
See #2332
(cherry picked from commit 43e58ac865ff862c2008c510fc5f7627e10b4660)
Diffstat (limited to 'tests/unit/browser/webkit/network/test_filescheme.py')
| -rw-r--r-- | tests/unit/browser/webkit/network/test_filescheme.py | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/tests/unit/browser/webkit/network/test_filescheme.py b/tests/unit/browser/webkit/network/test_filescheme.py index 5bdbb47cc..2654097ea 100644 --- a/tests/unit/browser/webkit/network/test_filescheme.py +++ b/tests/unit/browser/webkit/network/test_filescheme.py @@ -248,7 +248,7 @@ class TestFileSchemeHandler: def test_dir(self, tmpdir): url = QUrl.fromLocalFile(str(tmpdir)) req = QNetworkRequest(url) - reply = filescheme.handler(req) + reply = filescheme.handler(req, None, None) # The URL will always use /, even on Windows - so we force this here # too. tmpdir_path = str(tmpdir).replace(os.sep, '/') @@ -259,7 +259,7 @@ class TestFileSchemeHandler: filename.ensure() url = QUrl.fromLocalFile(str(filename)) req = QNetworkRequest(url) - reply = filescheme.handler(req) + reply = filescheme.handler(req, None, None) assert reply is None def test_unicode_encode_error(self, mocker): @@ -269,5 +269,5 @@ class TestFileSchemeHandler: err = UnicodeEncodeError('ascii', '', 0, 2, 'foo') mocker.patch('os.path.isdir', side_effect=err) - reply = filescheme.handler(req) + reply = filescheme.handler(req, None, None) assert reply is None |