[gentoo-commits] gentoo-x86 commit in kde-base/kdelibs/files: kdelibs-4.6.5-qlabel-2.patch kdelibs-4.7.1-qlabel-2.patch kdelibs-4.6.5-qlabel-1.patch kdelibs-4.7.1-qlabel-1.patch

[Andreas HAttel (dilfridge)]

dilfridge    11/10/03 13:29:21

  Added:                kdelibs-4.6.5-qlabel-2.patch
                        kdelibs-4.7.1-qlabel-2.patch
                        kdelibs-4.6.5-qlabel-1.patch
                        kdelibs-4.7.1-qlabel-1.patch
  Log:
  Fix QLabel spoofing vulnerability, bug 384227 and CVE-2011-3365
  
  (Portage version: 2.1.10.19/cvs/Linux x86_64)

Revision  Changes    Path
1.1                  kde-base/kdelibs/files/kdelibs-4.6.5-qlabel-2.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/kde-base/kdelibs/files/kdelibs-4.6.5-qlabel-2.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/kde-base/kdelibs/files/kdelibs-4.6.5-qlabel-2.patch?rev=1.1&content-type=text/plain

Index: kdelibs-4.6.5-qlabel-2.patch
===================================================================
diff --git a/kioslave/http/http.cpp b/kioslave/http/http.cpp
index 33f4cb1..6447a02 100644
--- a/kioslave/http/http.cpp
+++ b/kioslave/http/http.cpp
@@ -99,6 +99,27 @@
 //authentication handlers
 #include "httpauthentication.cpp"
 
+// KDE5 TODO (QT5) : use QString::htmlEscape or whatever https://qt.gitorious.org/qt/qtbase/merge_requests/56
+// ends up with.
+static QString htmlEscape(const QString &plain)
+{
+    QString rich;
+    rich.reserve(int(plain.length() * 1.1));
+        for (int i = 0; i < plain.length(); ++i) {
+        if (plain.at(i) == QLatin1Char('<'))
+            rich += QLatin1String("&lt;");
+        else if (plain.at(i) == QLatin1Char('>'))
+            rich += QLatin1String("&gt;");
+        else if (plain.at(i) == QLatin1Char('&'))
+            rich += QLatin1String("&amp;");
+        else if (plain.at(i) == QLatin1Char('"'))
+            rich += QLatin1String("&quot;");
+        else
+            rich += plain.at(i);
+    }
+    rich.squeeze();
+    return rich;
+}
 
 // see filenameFromUrl(): a sha1 hash is 160 bits
 static const int s_hashedUrlBits = 160;   // this number should always be divisible by eight
@@ -3410,7 +3431,7 @@ endParsing:
                                 authinfo.url = reqUrl;
                                 authinfo.keepPassword = true;
                                 authinfo.comment = i18n("<b>%1</b> at <b>%2</b>",
-                                                        authinfo.realmValue, authinfo.url.host());
+                                                        htmlEscape(authinfo.realmValue), authinfo.url.host());
 
                                 if (!openPasswordDialog(authinfo, errorMsg)) {
                                     if (sendErrorPageNotification()) {
@@ -5122,7 +5143,7 @@ void HTTPProtocol::proxyAuthenticationForSocket(const QNetworkProxy &proxy, QAut
                            "to access any sites.");
         info.keepPassword = true;
         info.commentLabel = i18n("Proxy:");
-        info.comment = i18n("<b>%1</b> at <b>%2</b>", info.realmValue, m_request.proxyUrl.host());
+        info.comment = i18n("<b>%1</b> at <b>%2</b>", htmlEscape(info.realmValue), m_request.proxyUrl.host());
         const bool dataEntered = openPasswordDialog(info, i18n("Proxy Authentication Failed."));
         if (!dataEntered) {
             kDebug(7103) << "looks like the user canceled proxy authentication.";



1.1                  kde-base/kdelibs/files/kdelibs-4.7.1-qlabel-2.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/kde-base/kdelibs/files/kdelibs-4.7.1-qlabel-2.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/kde-base/kdelibs/files/kdelibs-4.7.1-qlabel-2.patch?rev=1.1&content-type=text/plain

Index: kdelibs-4.7.1-qlabel-2.patch
===================================================================
diff --git a/kdecore/tests/kservicetest.cpp b/kdecore/tests/kservicetest.cpp
index 7f3b737..747e11a 100644
--- a/kdecore/tests/kservicetest.cpp
+++ b/kdecore/tests/kservicetest.cpp
@@ -31,6 +31,7 @@
 
 #include <kprotocolinfo.h>
 #include <kdebug.h>
+#include <kprocess.h>
 #include <kservicegroup.h>
 #include <kservicetypetrader.h>
 #include <kservicetype.h>
@@ -38,10 +39,23 @@
 
 #include <QtCore/Q_PID>
 
+QTEST_KDEMAIN_CORE( KServiceTest )
+
+static void eraseProfiles()
+{
+    QString profilerc = KStandardDirs::locateLocal( "config", "profilerc" );
+    if ( !profilerc.isEmpty() )
+        QFile::remove( profilerc );
+
+    profilerc = KStandardDirs::locateLocal( "config", "servicetype_profilerc" );
+    if ( !profilerc.isEmpty() )
+        QFile::remove( profilerc );
+}
+
 void KServiceTest::initTestCase()
 {
     // A non-C locale is necessary for some tests.
-    // This locale must have the follwing properties:
+    // This locale must have the following properties:
     //   - some character other than dot as decimal separator
     // If it cannot be set, locale-dependent tests are skipped.
     setlocale(LC_ALL, "fr_FR.utf8");
@@ -50,16 +64,8 @@ void KServiceTest::initTestCase()
         kDebug() << "Setting locale to fr_FR.utf8 failed";
     }
 
-    QString profilerc = KStandardDirs::locateLocal( "config", "profilerc" );
-    if ( !profilerc.isEmpty() )
-        QFile::remove( profilerc );
-
-    profilerc = KStandardDirs::locateLocal( "config", "servicetype_profilerc" );
-    if ( !profilerc.isEmpty() )
-        QFile::remove( profilerc );
-
     m_hasKde4Konsole = false;
-
+    eraseProfiles();
 
     // Create some fake services for the tests below, and ensure they are in ksycoca.
 
@@ -111,10 +117,23 @@ void KServiceTest::initTestCase()
         QVERIFY(QTest::kWaitForSignal(KSycoca::self(), SIGNAL(databaseChanged(QStringList)), 10000));
         kDebug() << "got signal";
     }
-
 }
 
-QTEST_KDEMAIN_CORE( KServiceTest )
+void KServiceTest::cleanupTestCase()
+{
+    // If I want the konqueror unit tests to work, then I better not have a non-working part
+    // as the preferred part for text/plain...
+    QStringList services; services << "fakeservice.desktop" << "fakepart.desktop" << "faketextplugin.desktop";
+    Q_FOREACH(const QString& service, services) {
+        const QString fakeService = KStandardDirs::locateLocal("services", service);
+        QFile::remove(fakeService);
+    }
+    //QProcess::execute( KGlobal::dirs()->findExe(KBUILDSYCOCA_EXENAME) );
+    KProcess proc;
+    proc << KStandardDirs::findExe(KBUILDSYCOCA_EXENAME);
+    proc.setOutputChannelMode(KProcess::MergedChannels); // silence kbuildsycoca output
+    proc.execute();
+}
 
 void KServiceTest::testByName()
 {
diff --git a/kdecore/tests/kservicetest.h b/kdecore/tests/kservicetest.h
index 18bddd9..ffab302 100644
--- a/kdecore/tests/kservicetest.h
+++ b/kdecore/tests/kservicetest.h
@@ -28,6 +28,7 @@ public:
     KServiceTest() : m_sycocaUpdateDone(0) {}
 private Q_SLOTS:
     void initTestCase();
+    void cleanupTestCase();
     void testByName();
     void testProperty();
     void testAllServiceTypes();
diff --git a/kioslave/http/http.cpp b/kioslave/http/http.cpp
index 6d41a13..3009ff1 100644
--- a/kioslave/http/http.cpp
+++ b/kioslave/http/http.cpp
@@ -86,6 +86,27 @@
 //string parsing helpers and HeaderTokenizer implementation
 #include "parsinghelpers.cpp"
 
+// KDE5 TODO (QT5) : use QString::htmlEscape or whatever https://qt.gitorious.org/qt/qtbase/merge_requests/56
+// ends up with.
+static QString htmlEscape(const QString &plain)
+{
+    QString rich;
+    rich.reserve(int(plain.length() * 1.1));
+        for (int i = 0; i < plain.length(); ++i) {
+        if (plain.at(i) == QLatin1Char('<'))
+            rich += QLatin1String("&lt;");
+        else if (plain.at(i) == QLatin1Char('>'))
+            rich += QLatin1String("&gt;");
+        else if (plain.at(i) == QLatin1Char('&'))
+            rich += QLatin1String("&amp;");
+        else if (plain.at(i) == QLatin1Char('"'))
+            rich += QLatin1String("&quot;");
+        else
+            rich += plain.at(i);
+    }
+    rich.squeeze();
+    return rich;
+}
 
 // see filenameFromUrl(): a sha1 hash is 160 bits
 static const int s_hashedUrlBits = 160;   // this number should always be divisible by eight
@@ -3431,7 +3452,7 @@ endParsing:
                                 authinfo.url = reqUrl;
                                 authinfo.keepPassword = true;
                                 authinfo.comment = i18n("<b>%1</b> at <b>%2</b>",
-                                                        authinfo.realmValue, authinfo.url.host());
+                                                        htmlEscape(authinfo.realmValue), authinfo.url.host());
 
                                 if (!openPasswordDialog(authinfo, errorMsg)) {
                                     if (sendErrorPageNotification()) {
@@ -5262,7 +5283,7 @@ void HTTPProtocol::proxyAuthenticationForSocket(const QNetworkProxy &proxy, QAut
                            "to access any sites.");
         info.keepPassword = true;
         info.commentLabel = i18n("Proxy:");
-        info.comment = i18n("<b>%1</b> at <b>%2</b>", info.realmValue, m_request.proxyUrl.host());
+        info.comment = i18n("<b>%1</b> at <b>%2</b>", htmlEscape(info.realmValue), m_request.proxyUrl.host());
         const bool dataEntered = openPasswordDialog(info, i18n("Proxy Authentication Failed."));
         if (!dataEntered) {
             kDebug(7103) << "looks like the user canceled proxy authentication.";



1.1                  kde-base/kdelibs/files/kdelibs-4.6.5-qlabel-1.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/kde-base/kdelibs/files/kdelibs-4.6.5-qlabel-1.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/kde-base/kdelibs/files/kdelibs-4.6.5-qlabel-1.patch?rev=1.1&content-type=text/plain

Index: kdelibs-4.6.5-qlabel-1.patch
===================================================================
diff --git a/kio/kssl/ksslcertificatebox.cpp b/kio/kssl/ksslcertificatebox.cpp
index 4ffc613..094787a 100644
--- a/kio/kssl/ksslcertificatebox.cpp
+++ b/kio/kssl/ksslcertificatebox.cpp
@@ -36,6 +36,10 @@ KSslCertificateBox::KSslCertificateBox(QWidget *parent)
    d(new KSslCertificateBoxPrivate())
 {
     d->ui.setupUi(this);
+    // No fooling us with html tags
+    Q_FOREACH(QLabel* label, qFindChildren<QLabel *>(this)) {
+        label->setTextFormat(Qt::PlainText);
+    }
 }
 
 



1.1                  kde-base/kdelibs/files/kdelibs-4.7.1-qlabel-1.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/kde-base/kdelibs/files/kdelibs-4.7.1-qlabel-1.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/kde-base/kdelibs/files/kdelibs-4.7.1-qlabel-1.patch?rev=1.1&content-type=text/plain

Index: kdelibs-4.7.1-qlabel-1.patch
===================================================================
diff --git a/kio/kssl/ksslcertificatebox.cpp b/kio/kssl/ksslcertificatebox.cpp
index 4ffc613..094787a 100644
--- a/kio/kssl/ksslcertificatebox.cpp
+++ b/kio/kssl/ksslcertificatebox.cpp
@@ -36,6 +36,10 @@ KSslCertificateBox::KSslCertificateBox(QWidget *parent)
    d(new KSslCertificateBoxPrivate())
 {
     d->ui.setupUi(this);
+    // No fooling us with html tags
+    Q_FOREACH(QLabel* label, qFindChildren<QLabel *>(this)) {
+        label->setTextFormat(Qt::PlainText);
+    }
 }