nixpkgs-suyu/pkgs/applications/networking/browsers/kwebkitpart/CVE-2014-8600.diff
Vladimír Čunát 15b9626a3d kde: fix CVE-2014-8600 by upstream patches
https://www.kde.org/info/security/advisory-20141113-1.txt
I couldn't find kio-extras, so I hope we don't have it disguised somewhere.
2014-12-10 19:38:50 +01:00

33 lines
1.3 KiB
Diff

--- a/src/webpage.cpp
+++ b/src/webpage.cpp
@@ -226,23 +226,26 @@
doc += QL1S( "<h3>" );
doc += i18n( "Details of the Request:" );
doc += QL1S( "</h3><ul><li>" );
- doc += i18n( "URL: %1", reqUrl.url() );
+ // escape URL twice: once for i18n, and once for HTML.
+ doc += i18n( "URL: %1", Qt::escape( Qt::escape( reqUrl.prettyUrl() ) ) );
doc += QL1S( "</li><li>" );
const QString protocol (reqUrl.protocol());
if ( !protocol.isNull() ) {
- doc += i18n( "Protocol: %1", protocol );
+ // escape protocol twice: once for i18n, and once for HTML.
+ doc += i18n( "Protocol: %1", Qt::escape( Qt::escape( protocol ) ) );
doc += QL1S( "</li><li>" );
}
doc += i18n( "Date and Time: %1",
KGlobal::locale()->formatDateTime(QDateTime::currentDateTime(), KLocale::LongDate) );
doc += QL1S( "</li><li>" );
- doc += i18n( "Additional Information: %1" , text );
+ // escape text twice: once for i18n, and once for HTML.
+ doc += i18n( "Additional Information: %1", Qt::escape( Qt::escape( text ) ) );
doc += QL1S( "</li></ul><h3>" );
doc += i18n( "Description:" );
doc += QL1S( "</h3><p>" );
- doc += description;
+ doc += Qt::escape( description );
doc += QL1S( "</p>" );
if ( causes.count() ) {