summaryrefslogtreecommitdiff
path: root/tests
AgeCommit message (Collapse)Author
2021-10-21CVE-2021-41146: Add --untrusted-args to avoid argument injectionFlorian Bruhin
On Windows, if an application is registered as an URL handler like this: HKEY_CLASSES_ROOT https URL Protocol = "" [...] shell open command (Default) = ".../qutebrowser.exe" "%1" one would think that Windows takes care of making sure URLs can't inject arguments by containing a quote. However, this is not the case, as stated by the Microsoft docs: https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/aa767914(v=vs.85) Security Warning: Applications that handle URI schemes must consider how to respond to malicious data. Because handler applications can receive data from untrusted sources, the URI and other parameter values passed to the application may contain malicious data that attempts to exploit the handling application. and As noted above, the string that is passed to a pluggable protocol handler might be broken across multiple parameters. Malicious parties could use additional quote or backslash characters to pass additional command line parameters. For this reason, pluggable protocol handlers should assume that any parameters on the command line could come from malicious parties, and carefully validate them. Applications that could initiate dangerous actions based on external data must first confirm those actions with the user. In addition, handling applications should be tested with URIs that are overly long or contain unexpected (or undesirable) character sequences. Indeed it's trivial to pass a command to qutebrowser this way - given how trivial the exploit is to recreate given the information above, here's a PoC: https:x" ":spawn calc (or qutebrowserurl: instead of https: if qutebrowser isn't registered as a default browser) Some applications do escape the quote characters before calling qutebrowser - but others, like Outlook Desktop or .url files, do not. As a fix, we add an --untrusted-args flag and some early validation of the raw sys.argv, before parsing any arguments or e.g. creating a QApplication (which might already allow injecting Qt flags there). We assume that there's no way for an attacker to inject flags *before* the %1 placeholder in the registry, and add --untrusted-args as the last argument of the registry entry. This way, it'd still be possible for users to customize their invocation flags without having to remove --untrusted-args. After --untrusted-args, however, we have some rather strict checks: - There should be zero or one arguments, but not two (or more) - Any argument may not start with - (flag) or : (qutebrowser command) We also add the --untrusted-args flag to the Linux .desktop file, though it should not be needed there, as the specification there is sane: https://specifications.freedesktop.org/desktop-entry-spec/desktop-entry-spec-latest.html#exec-variables Implementations must take care not to expand field codes into multiple arguments unless explicitly instructed by this specification. This means that name fields, filenames and other replacements that can contain spaces must be passed as a single argument to the executable program after expansion. There is no comparable mechanism on macOS, which opens the application without arguments and then sends an "open" event to it: https://doc.qt.io/qt-5/qfileopenevent.html This issue was introduced in qutebrowser v1.7.0 which started registering it as URL handler: baee2888907b260881d5831c68500941937261a0 / #4086 This is by no means an issue isolated to qutebrowser. Many other projects have had similar trouble with Windows' rather unexpected behavior: Electron / Exodus Bitcoin wallet: - http://web.archive.org/web/20190702112128/https://medium.com/0xcc/electrons-bug-shellexecute-to-blame-cacb433d0d62 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000006 - https://medium.com/hackernoon/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374 IE/Firefox: - https://bugzilla.mozilla.org/show_bug.cgi?id=384384 - https://bugzilla.mozilla.org/show_bug.cgi?id=1572838 Others: - http://web.archive.org/web/20210930203632/https://www.vdoo.com/blog/exploiting-custom-protocol-handlers-in-windows - https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/ - etc. etc. See CVE-2021-41146 / GHSA-vw27-fwjf-5qxm: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41146 https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-vw27-fwjf-5qxm Thanks to Ping Fan (Zetta) Ke of Valkyrie-X Security Research Group (VXRL/@vxresearch) for finding and responsibly disclosing this issue. (cherry picked from commit 8f46ba3f6dc7b18375f7aa63c48a1fe461190430)
2021-06-01Make dark mode tests work correctly on ARM/aarch64Florian Bruhin
Fixes #6489 (cherry picked from commit b4b65b8cd158aecea11e7d074d941f8c3908ab66)
2021-05-30Handle un-encodable initial text for editorFlorian Bruhin
(cherry picked from commit c74d1075620f54d8904b9ae822299ba1221450f4)
2021-05-30Validate encoding for header settingsFlorian Bruhin
Also needed to add encoding check support to FormatString. (cherry picked from commit 996487c43e4fcc265b541f9eca1e7930e3c5cf05)
2021-05-30tests: Update import path for pytestqt SignalBlockerFlorian Bruhin
(cherry picked from commit 03fa9383833c6262b08a5f7c4930143e39327173)
2021-05-29tests: Fix test_system_default_rendering with Noto Sans MonoFlorian Bruhin
(cherry picked from commit 33596cfa4abb70df87551600d4c1eeb79a27c106)
2021-05-28Fix tests/lintFlorian Bruhin
We need to set XDG_RUNTIME_DIR properly in the tests so that the log is empty. (cherry picked from commit 1830f784df18057f5e07a59256cc73b5fea91a86)
2021-05-28log: Handle JSONLogger in change_console_formatterFlorian Bruhin
Fixes #6482 (cherry picked from commit 40477e826c9ec73a8f99177df645094be3ef5ed3)
2021-05-26RIP FreenodeFlorian Bruhin
(cherry picked from commit 7961cf73553847ea265a388b736fffac77dae66a)
2021-05-18Fix crash in cmd completion for set-cmd-text.Ryan Roden-Corrent
2c4bb064e introduced support for showing bindings in the completion menu for commands initiated with set-cmd-text. This would crash if given a binding for just 'set-cmd-text' with no args. Fixes #6453. (cherry picked from commit a36efcf6b5b08666c2a65f8d2eef90eaba832fe6)
2021-05-18Remove service workers based on QtWebEngine versionFlorian Bruhin
See https://bugreports.qt.io/browse/QTBUG-93744 (cherry picked from commit b03b03bdf6e02e13b348689bf7b18196432f232b) Additional fixups: Store initial QtWebEngine version (cherry picked from commit 948fd5040d81228452fd72a0170a0d8fe35839a9) Fix state config unit tests (cherry picked from commit 335ed484c1f8b6e5417d9000ae226b4f9a85b28f) Fix running without QtWebEngine (cherry picked from commit 57ed85ffad3278d159d1ebd03081a5e719b952cb) Remove unused imports (cherry picked from commit 9e52ad621ac44d0391c2c6d9dbdda967f7ce95f0) Fix tests without QtWebEngine (cherry picked from commit ac12fcd714c699f927170b3d0508336940366bac)
2021-04-29Add QUTE_QTWEBENGINE_VERSION_OVERRIDEFlorian Bruhin
See https://github.com/NixOS/nixpkgs/pull/119376#issuecomment-820073044 (cherry picked from commit febb921040b6670d9b1694a6ce55ae39384d1306)
2021-04-29tests: Fix test_version with git's init.defaultBranchFlorian Bruhin
(cherry picked from commit 32604a6651813e25ee6d328c880ef95f76c9c744)
2021-04-23Fix tests on WindowsFlorian Bruhin
(cherry picked from commit 0ee169e497de97d13bbd1b0c50e11bd452d5d25f)
2021-04-23Fix :spawn -u -oFlorian Bruhin
Fixes #6407 (cherry picked from commit c7b3559d820ebdc8b3077fce3d782e6ab81cb732)
2021-04-13Fix quirk testsFlorian Bruhin
2021-04-10Merge commit '9a836e2'Florian Bruhin
2021-04-09notifications: Fix image padding assertionFlorian Bruhin
The underlying Chromium pads images so that scanlines align on 4-byte boundaries. Thus, with an image size of e.g. 239x239, we'll have 3 bytes of padding (239 mod 4 = 3; 240 mod 4 = 0). Fixes #6375
2021-04-09Remove confusing returnFlorian Bruhin
2021-04-09Added tests for StatusbarWidget.Nicholas Schwab
2021-04-08Revert all prefix-related commits.Nicholas Schwab
This reverts commits 02a64630aa83e37e47a28a60366e1c65f0eba3ac to 4ff204aecc96d77209a18594a14da96af703c43f.
2021-04-08Added tests for get_valid_prefixes.Nicholas Schwab
2021-04-08Added tests for configtypes.PrefixOrString.Nicholas Schwab
2021-04-08Added tests for ValidPrefixes.Nicholas Schwab
2021-04-08Remove unused importsFlorian Bruhin
2021-04-08Fix enum stringification for Python 3.10 a7+Florian Bruhin
https://bugs.python.org/issue40066 https://mail.python.org/archives/list/python-dev@python.org/message/CHQW6THTDYNPPFWQ2KDDTUYSAJDCZFNP/ https://github.com/python/cpython/commit/b775106d940e3d77c8af7967545bb9a5b7b162df
2021-04-07Don't parse distribution versionsFlorian Bruhin
We don't actually need those values anywhere, and parsing can be tricky as there isn't a fixed format for those version numbers. Let's just not do it at all. See #6354.
2021-04-07Handle version numbers with >3 digitsFlorian Bruhin
Closes #6354
2021-04-06Simplify pathlib usage in webserver_sub_sslFlorian Bruhin
2021-04-05Fix elf testsFlorian Bruhin
2021-04-04Show error when using :config-unset with uncustomized settingFlorian Bruhin
2021-04-04Add URL pattern support for :config-unsetFlorian Bruhin
See #5856
2021-03-31tests: Skip test_real_chromium_version if guessing too muchFlorian Bruhin
2021-03-31tests: Fix accidental network accessFlorian Bruhin
Running :adblock-update also updates ABP lists and thus tries downloading easylist.
2021-03-31tests: Make test_real_chromium_version clearerFlorian Bruhin
2021-03-31flatpak: Try getting ID from /.flatpak_infoFlorian Bruhin
2021-03-31flatpak: Make things work without FLATPAK_IDFlorian Bruhin
2021-03-31flatpak: Fix standarddir/ipc testsFlorian Bruhin
2021-03-31tests: Move flatpak patch to conftestFlorian Bruhin
2021-03-31ci: Move test_mkvenv.py to update-dependenciesFlorian Bruhin
It requires some time and network access, so no need to run it as part of the automated tests.
2021-03-31tests: Ignore mDNS errorsFlorian Bruhin
They happen with data/crashers/webrtc.html in Flatpak and are harmless.
2021-03-31flatpak: Skip download dispatcher testsFlorian Bruhin
2021-03-31Fix botched commentFlorian Bruhin
Accidentally changed in 8a0d7a5be801b4d7370b97ad14715a7c9261226d
2021-03-31flatpak: Get correct path to QtWebEngine localesFlorian Bruhin
2021-03-29ipc: Fix socket handlingFlorian Bruhin
Speculatively fixes #5344
2021-03-29Revert "ipc: Remove _old_socket handling"Florian Bruhin
This reverts commit c6cf3067e158265096410afee98407826b19c472. Seems to cause segfaults: #0 0x00007ffff5cecbcc in void doActivate<false>(QObject*, int, void**) () from /home/florian/proj/qutebrowser/git/.tox/py39-pyqt515/lib/python3.9/site-packages/PyQt5/Qt5/lib/libQt5Core.so.5 #1 0x00007ffff5be4e31 in QIODevice::channelReadyRead(int) () from /home/florian/proj/qutebrowser/git/.tox/py39-pyqt515/lib/python3.9/site-packages/PyQt5/Qt5/lib/libQt5Core.so.5 #2 0x00007fffeffccb54 in QAbstractSocketPrivate::canReadNotification() () from /home/florian/proj/qutebrowser/git/.tox/py39-pyqt515/lib/python3.9/site-packages/PyQt5/Qt5/lib/libQt5Network.so.5 #3 0x00007fffeffdf061 in QReadNotifier::event(QEvent*) () from /home/florian/proj/qutebrowser/git/.tox/py39-pyqt515/lib/python3.9/site-packages/PyQt5/Qt5/lib/libQt5Network.so.5 #4 0x00007ffff269e43c in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /home/florian/proj/qutebrowser/git/.tox/py39-pyqt515/lib/python3.9/site-packages/PyQt5/Qt5/lib/libQt5Widgets.so.5 #5 0x00007ffff26a4f20 in QApplication::notify(QObject*, QEvent*) () from /home/florian/proj/qutebrowser/git/.tox/py39-pyqt515/lib/python3.9/site-packages/PyQt5/Qt5/lib/libQt5Widgets.so.5 #6 0x00007ffff318d0d6 in sipQApplication::notify(QObject*, QEvent*) () from /home/florian/proj/qutebrowser/git/.tox/py39-pyqt515/lib/python3.9/site-packages/PyQt5/QtWidgets.abi3.so #7 0x00007ffff5cb4808 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /home/florian/proj/qutebrowser/git/.tox/py39-pyqt515/lib/python3.9/site-packages/PyQt5/Qt5/lib/libQt5Core.so.5 #8 0x00007ffff5d10d98 in socketNotifierSourceDispatch(_GSource*, int (*)(void*), void*) () from /home/florian/proj/qutebrowser/git/.tox/py39-pyqt515/lib/python3.9/site-packages/PyQt5/Qt5/lib/libQt5Core.so.5 #9 0x00007ffff691df9c in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 #10 0x00007ffff6971a49 in ?? () from /usr/lib/libglib-2.0.so.0 #11 0x00007ffff691b6f1 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0 #12 0x00007ffff5d101cc in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /home/florian/proj/qutebrowser/git/.tox/py39-pyqt515/lib/python3.9/site-packages/PyQt5/Qt5/lib/libQt5Core.so.5 #13 0x00007ffff5cb321a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /home/florian/proj/qutebrowser/git/.tox/py39-pyqt515/lib/python3.9/site-packages/PyQt5/Qt5/lib/libQt5Core.so.5 #14 0x00007ffff5cbc1d3 in QCoreApplication::exec() () from /home/florian/proj/qutebrowser/git/.tox/py39-pyqt515/lib/python3.9/site-packages/PyQt5/Qt5/lib/libQt5Core.so.5
2021-03-29ipc: Remove _old_socket handlingFlorian Bruhin
Seems to cause more trouble than it solves nowadays.
2021-03-29scripts: Pass GitHub token via commandline argsFlorian Bruhin
2021-03-29tests: Test QtWebEngine version guessing when frozenFlorian Bruhin
2021-03-29tests: Move freezer to fixtures.pyFlorian Bruhin
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion