Skip to content

Add sanitizing of document title

Agata Cacko requested to merge tymond/krita:tiar/fix_zip_traversal_issues_on_unsanitized_document_titles into master

Before this commit, you could use any string for a document title. This commit ensures that user won't be able to use / or
in their document title.

BUG:429925 https://bugs.kde.org/show_bug.cgi?id=429925

Examples of behaviour before:

  • A. document title: test Correct file. Layers etc. were located in the archive in directory called test
  • B. document title: test/ There was no way to open the file later correctly without editing the metadata file (maindoc.xml or documentinfo.xml, not sure because I haven't checked) because Krita would look for layers in test//layers/ instead of test/layers/. (This issue always happened for document titles ending with \)
  • C. document title: testA/testB Correct file. Layers etc. were located in the archive in a directory called testB which was located in a directory called testA.
  • D. document title: ../../../test Correct file. Layers etc. were located in the path ../../../test, which means in test located in directory called .. in .. in ...

After this fix, the files that were still correctly opened before this change (files with document titles with / but not having / at the end) are still correctly opened, and saved if the user doesn't change the document title.

This fix only prevents creating new files with those document titles because of both the possibility of creating an incorrect file and the unnecessary nesting of directories.

Test Plan

  1. Try to create a file with document title with \ at the end (impossible after this change; if done before this change, it will create a file that cannot be opened correctly)
  2. Try to create a file with document title containing \ or / (impossible after this change; if done before this change, at least in case of / on my Linux system, it would create nesting directories inside the .kra file that correspond to the document title treated as a path)
  3. Create a file containing \ and/or / (but ending with a different character) that opened before this MR. Make sure it opens after this MR as well. And you can edit it and save and open again without issues (and the document title is intact).

Formalities Checklist

  • I confirmed this builds.
  • I confirmed Krita ran and the relevant functions work.
  • I tested the relevant unit tests and can confirm they are not broken. (If not possible, don't hesitate to ask for help!)
  • I made sure my commits build individually and have good descriptions as per KDE guidelines.
  • I made sure my code conforms to the standards set in the HACKING file.
  • I can confirm the code is licensed and attributed appropriately, and that unattributed code is mine, as per KDE Licensing Policy.

Merge request reports