| Age | Commit message (Collapse) | Author |
|---|
|
On Windows, if an application is registered as an URL handler like this:
HKEY_CLASSES_ROOT
https
URL Protocol = ""
[...]
shell
open
command
(Default) = ".../qutebrowser.exe" "%1"
one would think that Windows takes care of making sure URLs can't inject
arguments by containing a quote. However, this is not the case, as
stated by the Microsoft docs:
https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/aa767914(v=vs.85)
Security Warning: Applications that handle URI schemes must consider how to
respond to malicious data. Because handler applications can receive data
from untrusted sources, the URI and other parameter values passed to the
application may contain malicious data that attempts to exploit the handling
application.
and
As noted above, the string that is passed to a pluggable protocol handler
might be broken across multiple parameters. Malicious parties could use
additional quote or backslash characters to pass additional command line
parameters. For this reason, pluggable protocol handlers should assume that
any parameters on the command line could come from malicious parties, and
carefully validate them. Applications that could initiate dangerous actions
based on external data must first confirm those actions with the user. In
addition, handling applications should be tested with URIs that are overly
long or contain unexpected (or undesirable) character sequences.
Indeed it's trivial to pass a command to qutebrowser this way - given how
trivial the exploit is to recreate given the information above, here's a PoC:
https:x" ":spawn calc
(or qutebrowserurl: instead of https: if qutebrowser isn't registered as a
default browser)
Some applications do escape the quote characters before calling
qutebrowser - but others, like Outlook Desktop or .url files, do not.
As a fix, we add an --untrusted-args flag and some early validation of the raw
sys.argv, before parsing any arguments or e.g. creating a QApplication (which
might already allow injecting Qt flags there).
We assume that there's no way for an attacker to inject flags *before* the %1
placeholder in the registry, and add --untrusted-args as the last argument of
the registry entry. This way, it'd still be possible for users to customize
their invocation flags without having to remove --untrusted-args.
After --untrusted-args, however, we have some rather strict checks:
- There should be zero or one arguments, but not two (or more)
- Any argument may not start with - (flag) or : (qutebrowser command)
We also add the --untrusted-args flag to the Linux .desktop file, though it
should not be needed there, as the specification there is sane:
https://specifications.freedesktop.org/desktop-entry-spec/desktop-entry-spec-latest.html#exec-variables
Implementations must take care not to expand field codes into multiple
arguments unless explicitly instructed by this specification. This means
that name fields, filenames and other replacements that can contain spaces
must be passed as a single argument to the executable program after
expansion.
There is no comparable mechanism on macOS, which opens the application without
arguments and then sends an "open" event to it:
https://doc.qt.io/qt-5/qfileopenevent.html
This issue was introduced in qutebrowser v1.7.0 which started registering it as
URL handler: baee2888907b260881d5831c68500941937261a0 / #4086
This is by no means an issue isolated to qutebrowser. Many other projects have
had similar trouble with Windows' rather unexpected behavior:
Electron / Exodus Bitcoin wallet:
- http://web.archive.org/web/20190702112128/https://medium.com/0xcc/electrons-bug-shellexecute-to-blame-cacb433d0d62
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000006
- https://medium.com/hackernoon/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374
IE/Firefox:
- https://bugzilla.mozilla.org/show_bug.cgi?id=384384
- https://bugzilla.mozilla.org/show_bug.cgi?id=1572838
Others:
- http://web.archive.org/web/20210930203632/https://www.vdoo.com/blog/exploiting-custom-protocol-handlers-in-windows
- https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/
- etc. etc.
See CVE-2021-41146 / GHSA-vw27-fwjf-5qxm:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41146
https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-vw27-fwjf-5qxm
Thanks to Ping Fan (Zetta) Ke of Valkyrie-X Security Research Group
(VXRL/@vxresearch) for finding and responsibly disclosing this issue.
(cherry picked from commit 8f46ba3f6dc7b18375f7aa63c48a1fe461190430)
|
|
|
|
Fixes #6489
(cherry picked from commit 9ff9fd0a0244aa8ffc2fb56cbb7ba445d75f0b9c)
|
|
(Hopefully) fixes #6394.
(cherry picked from commit a3f9cad456f69a9febb65a27510f56d0d8b2f34f)
|
|
(cherry picked from commit c74d1075620f54d8904b9ae822299ba1221450f4)
|
|
(cherry picked from commit f0d432565bf71919413caf76522d6ad34bb0ebc4)
|
|
Needed for a bugfix in the next commit.
(cherry picked from commit 505a24c580f51ac77445fc74517ddfbbf285b411)
|
|
Also needed to add encoding check support to FormatString.
(cherry picked from commit 996487c43e4fcc265b541f9eca1e7930e3c5cf05)
|
|
(cherry picked from commit 380de52c9371fa527d43ac98a16294f171442855)
|
|
We need to check for the QtWebEngine version, not for the version of Qt.
Additionally, there's no need to re-check in DBusNotificationAdapter.__init__ as
it never gets instantiated on older versions, so it's now an assertion instead.
(cherry picked from commit f8c2b0a7e7b7251a5ff5bf475802702c1953a266)
|
|
We need to set XDG_RUNTIME_DIR properly in the tests so that the log is empty.
(cherry picked from commit 1830f784df18057f5e07a59256cc73b5fea91a86)
|
|
Fixes #6482
(cherry picked from commit 40477e826c9ec73a8f99177df645094be3ef5ed3)
|
|
|
|
assertions are disabled
(cherry picked from commit 502832ac1989858fe98bd8b874ff92e6404180ad)
|
|
2c4bb064e introduced support for showing bindings in the completion menu
for commands initiated with set-cmd-text. This would crash if given a
binding for just 'set-cmd-text' with no args.
Fixes #6453.
(cherry picked from commit a36efcf6b5b08666c2a65f8d2eef90eaba832fe6)
|
|
See #6464, #5472, #4805, #4810
e010afd3a20a86639396a9c844abfea7b23cc67a
https://bugreports.qt.io/browse/QTBUG-69652
(cherry picked from commit 8e617d010a5cd305ff42191ea6458a2d003b6d46)
|
|
See https://bugreports.qt.io/browse/QTBUG-93744
(cherry picked from commit b03b03bdf6e02e13b348689bf7b18196432f232b)
Additional fixups:
Store initial QtWebEngine version
(cherry picked from commit 948fd5040d81228452fd72a0170a0d8fe35839a9)
Fix state config unit tests
(cherry picked from commit 335ed484c1f8b6e5417d9000ae226b4f9a85b28f)
Fix running without QtWebEngine
(cherry picked from commit 57ed85ffad3278d159d1ebd03081a5e719b952cb)
Remove unused imports
(cherry picked from commit 9e52ad621ac44d0391c2c6d9dbdda967f7ce95f0)
Fix tests without QtWebEngine
(cherry picked from commit ac12fcd714c699f927170b3d0508336940366bac)
|
|
(cherry picked from commit 63b8269f5caed26474141254859cf5dcba9209d3)
|
|
|
|
See https://github.com/NixOS/nixpkgs/pull/119376#issuecomment-820073044
(cherry picked from commit febb921040b6670d9b1694a6ce55ae39384d1306)
|
|
(cherry picked from commit 38c5eba3e1e07448a3c1fd082dc418e916c13dc2)
|
|
documentation more uniform.
(cherry picked from commit a083728168e3c126b8b6a67aa3d4d03845da8a46)
|
|
Closes #4379
(cherry picked from commit be37524f47bcb78a319eae4e1d61794dfec6cc36)
|
|
This reverts commit 1e5184bc71f0209744bc93287b4c9bdc172bc5a0.
|
|
See https://codereview.qt-project.org/c/qt/qtwebengine/+/344042
(cherry picked from commit 2e4ca779c68a65034fcd4448fa8c0952ed3f0a1d)
|
|
Fixes #6407
(cherry picked from commit c7b3559d820ebdc8b3077fce3d782e6ab81cb732)
|
|
(cherry picked from commit 9fdfd3b4c02be01824900c5e548994495be4ccea)
|
|
Otherwise their notifications could suddenly stop working or otherwise
change apperance.
(cherry picked from commit ebf96195839c5288981c62b4c6fd18dd99e829be)
|
|
(cherry picked from commit 2cfc64579a22e7dd933c9591e6bb141b877b58e0)
|
|
|
|
Fixes #6208
|
|
|
|
When running ua_fetch.py, websettings gets imported and fails:
$ python3 scripts/dev/ua_fetch.py
Traceback (most recent call last):
File ".../scripts/dev/ua_fetch.py", line 16, in <module>
import qutebrowser.config.websettings
File ".../qutebrowser/config/websettings.py", line 32, in <module>
from qutebrowser.config import config
File ".../qutebrowser/config/config.py", line 31, in <module>
from qutebrowser.config import configdata, configexc, configutils
File ".../qutebrowser/config/configdata.py", line 32, in <module>
from qutebrowser.config import configtypes
File ".../qutebrowser/config/configtypes.py", line 65, in <module>
from qutebrowser.utils import (standarddir, utils, qtutils, urlutils, urlmatch,
File ".../qutebrowser/utils/standarddir.py", line 33, in <module>
from qutebrowser.utils import log, debug, utils, version
File ".../qutebrowser/utils/version.py", line 529, in <module>
class WebEngineVersions:
File ".../qutebrowser/utils/version.py", line 597, in WebEngineVersions
def from_ua(cls, ua: websettings.UserAgent) -> 'WebEngineVersions':
AttributeError: partially initialized module 'qutebrowser.config.websettings' has no attribute 'UserAgent' (most likely due to a circular import)
|
|
|
|
The underlying Chromium pads images so that scanlines align on 4-byte
boundaries. Thus, with an image size of e.g. 239x239, we'll have 3 bytes
of padding (239 mod 4 = 3; 240 mod 4 = 0).
Fixes #6375
|
|
|
|
|
|
Co-authored-by: Florian Bruhin <me@the-compiler.org>
|
|
|
|
Co-authored-by: Florian Bruhin <me@the-compiler.org>
|
|
|
|
|
|
|
|
|
|
This reverts commits 02a64630aa83e37e47a28a60366e1c65f0eba3ac to 4ff204aecc96d77209a18594a14da96af703c43f.
|
|
|
|
|
|
|
|
|
|
documentation.
|
