diff options
| author | Thomas <thomas.giudici@proton.me> | 2026-06-18 13:34:27 +0200 |
|---|---|---|
| committer | Thomas <thomas.giudici@proton.me> | 2026-06-18 14:17:25 +0200 |
| commit | 3d3a391ef43b1ac09160f4d572d5fbf85f249dc8 (patch) | |
| tree | 4b6225110645f6936e7ad1617cdea0ed5ad32cb9 /pages | |
| parent | a003cb75b6416488d0a448198e6de03211ae1a67 (diff) | |
| download | monzero-gui-3d3a391ef43b1ac09160f4d572d5fbf85f249dc8.tar.gz monzero-gui-3d3a391ef43b1ac09160f4d572d5fbf85f249dc8.tar.xz monzero-gui-3d3a391ef43b1ac09160f4d572d5fbf85f249dc8.zip | |
qml: escape untrusted text in remaining RichText views
Extends the escaping from commit 23ec5eb6 to the RichText sinks it did
not cover: the transaction note in the tx details popup (History), the
wallet name and account label in the send confirmation
(TxConfirmationDialog), the address label on the merchant page
(Merchant), and the wallet path on the info page (SettingsInfo). These
were interpolated unescaped, so a value containing markup is rendered as
rich text.
The transaction note is the notable case: it can be set from a payment
request's tx_description, so it is attacker influenced.
Escape these fields with Utils.htmlEscape. Set the send confirmation
From field to Text.RichText explicitly so the escaped entities decode in
both of its branches; the single-account branch contains no tag and
would otherwise render as plain text and show the raw entity.
Diffstat (limited to 'pages')
| -rw-r--r-- | pages/History.qml | 2 | ||||
| -rw-r--r-- | pages/merchant/Merchant.qml | 2 | ||||
| -rw-r--r-- | pages/settings/SettingsInfo.qml | 2 |
3 files changed, 3 insertions, 3 deletions
diff --git a/pages/History.qml b/pages/History.qml index d9132e3b..6871405d 100644 --- a/pages/History.qml +++ b/pages/History.qml @@ -1746,7 +1746,7 @@ Rectangle { + (paymentId ? trStart + qsTr("Payment ID:") + trMiddle + paymentId + trEnd : "") + (integratedAddress ? trStart + qsTr("Integrated address") + ":" + trMiddle + integratedAddress + trEnd : "") + (tx_key ? trStart + qsTr("Tx key:") + trMiddle + tx_key + trEnd : "") - + (tx_note ? trStart + qsTr("Tx note:") + trMiddle + tx_note + trEnd : "") + + (tx_note ? trStart + qsTr("Tx note:") + trMiddle + Utils.htmlEscape(tx_note) + trEnd : "") + (destinations ? trStart + qsTr("Destinations:") + trMiddle + destinations + trEnd : "") + (rings ? trStart + qsTr("Rings:") + trMiddle + rings + trEnd : "") + "</table>" diff --git a/pages/merchant/Merchant.qml b/pages/merchant/Merchant.qml index 560484b1..86d47560 100644 --- a/pages/merchant/Merchant.qml +++ b/pages/merchant/Merchant.qml @@ -295,7 +295,7 @@ Item { color: "white" text: "<style type='text/css'>a {text-decoration: none; color: #FF6C3C; font-size: 12px;}</style>%1: %2 <a href='#'>(%3)</a>" .arg(qsTr("Currently selected address")) - .arg(addressLabel) + .arg(Utils.htmlEscape(addressLabel)) .arg(qsTr("Change")) + translationManager.emptyString textFormat: Text.RichText themeTransition: false diff --git a/pages/settings/SettingsInfo.qml b/pages/settings/SettingsInfo.qml index ad152d63..e126383a 100644 --- a/pages/settings/SettingsInfo.qml +++ b/pages/settings/SettingsInfo.qml @@ -142,7 +142,7 @@ Rectangle { <style type='text/css'>\ a {cursor:pointer;text-decoration: none; color: #FF6C3C}\ </style>\ - <a href='#'>%1</a>".arg(walletPath) + <a href='#'>%1</a>".arg(Utils.htmlEscape(walletPath)) textFormat: Text.RichText onLinkActivated: oshelper.openContainingFolder(walletPath) |