Skip to content

Commit 7bfe061

Browse files
ogoffartguruz
ogoffart
authored and
guruz
committedFeb 23, 2017
Verify that all strings are properly escaped (#5558)
- I checked every occurence of a '%2' and make correct use of the QString::arg overload that takes several argument instead of chaining them, because the first argument can contains a '%1' - I tried to look for every label that they either use plain text or richtext and escape the user provided strings in there.
·
v6.0.0-rc.1v2.3.0-rc2
1 parent 1333252 commit 7bfe061

31 files changed

+154
-58
lines changed
 

‎src/gui/accountsettings.cpp

+11-7
Original file line numberDiff line numberDiff line change
@@ -552,10 +552,12 @@ void AccountSettings::slotAccountStateChanged(int state)
552552
_model->slotUpdateFolderState(folder);
553553
}
554554

555-
QString server = QString::fromLatin1("<a href=\"%1\">%2</a>").arg(account->url().toString(), safeUrl.toString());
555+
QString server = QString::fromLatin1("<a href=\"%1\">%2</a>")
556+
.arg(Utility::escape(account->url().toString()),
557+
Utility::escape(safeUrl.toString()));
556558
QString serverWithUser = server;
557559
if (AbstractCredentials *cred = account->credentials()) {
558-
serverWithUser = tr("%1 as <i>%2</i>").arg(server, cred->user());
560+
serverWithUser = tr("%1 as <i>%2</i>").arg(server, Utility::escape(cred->user()));
559561
}
560562

561563
if (state == AccountState::Connected) {
@@ -569,13 +571,14 @@ void AccountSettings::slotAccountStateChanged(int state)
569571
} else if (state == AccountState::SignedOut) {
570572
showConnectionLabel( tr("Signed out from %1.").arg(serverWithUser) );
571573
} else {
572-
showConnectionLabel( tr("No connection to %1 at %2.")
573-
.arg(Theme::instance()->appNameGUI(),
574-
server), _accountState->connectionErrors() );
574+
showConnectionLabel(tr("No connection to %1 at %2.")
575+
.arg(Utility::escape(Theme::instance()->appNameGUI()), server),
576+
_accountState->connectionErrors());
575577
}
576578
} else {
577579
// ownCloud is not yet configured.
578-
showConnectionLabel( tr("No %1 connection configured.").arg(Theme::instance()->appNameGUI()) );
580+
showConnectionLabel(tr("No %1 connection configured.")
581+
.arg(Utility::escape(Theme::instance()->appNameGUI())));
579582
}
580583

581584
/* Allow to expand the item if the account is connected. */
@@ -664,7 +667,8 @@ void AccountSettings::refreshSelectiveSyncStatus()
664667
}
665668
QModelIndex theIndx = _model->indexForPath(folder, myFolder);
666669
if(theIndx.isValid()) {
667-
msg += QString::fromLatin1("<a href=\"%1?folder=%2\">%1</a>").arg(myFolder).arg(folder->alias());
670+
msg += QString::fromLatin1("<a href=\"%1?folder=%2\">%1</a>")
671+
.arg(Utility::escape(myFolder), Utility::escape(folder->alias()));
668672
} else {
669673
msg += myFolder; // no link because we do not know the index yet.
670674
}

‎src/gui/accountsettings.ui

+9
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,9 @@
4141
<property name="text">
4242
<string>Connected with &lt;server&gt; as &lt;user&gt;</string>
4343
</property>
44+
<property name="textFormat">
45+
<enum>Qt::RichText</enum>
46+
</property>
4447
<property name="wordWrap">
4548
<bool>true</bool>
4649
</property>
@@ -75,6 +78,9 @@
7578
<property name="text">
7679
<string>Storage space: ...</string>
7780
</property>
81+
<property name="textFormat">
82+
<enum>Qt::PlainText</enum>
83+
</property>
7884
<property name="wordWrap">
7985
<bool>false</bool>
8086
</property>
@@ -145,6 +151,9 @@
145151
<property name="text">
146152
<string>Unchecked folders will be &lt;b&gt;removed&lt;/b&gt; from your local file system and will not be synchronized to this computer anymore</string>
147153
</property>
154+
<property name="textFormat">
155+
<enum>Qt::RichText</enum>
156+
</property>
148157
<property name="wordWrap">
149158
<bool>true</bool>
150159
</property>

‎src/gui/activityitemdelegate.cpp

+2-2
Original file line numberDiff line numberDiff line change
@@ -142,9 +142,9 @@ void ActivityItemDelegate::paint(QPainter *painter, const QStyleOptionViewItem &
142142

143143
QString timeStr;
144144
if ( accountOnline ) {
145-
timeStr = tr("%1 on %2").arg(timeText).arg(accountRole);
145+
timeStr = tr("%1 on %2").arg(timeText, accountRole);
146146
} else {
147-
timeStr = tr("%1 on %2 (disconnected)").arg(timeText).arg(accountRole);
147+
timeStr = tr("%1 on %2 (disconnected)").arg(timeText, accountRole);
148148
QPalette p = option.palette;
149149
painter->setPen(p.color(QPalette::Disabled, QPalette::Text));
150150
}

‎src/gui/activitywidget.ui

+9
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@
2525
<property name="text">
2626
<string>TextLabel</string>
2727
</property>
28+
<property name="textFormat">
29+
<enum>Qt::PlainText</enum>
30+
</property>
2831
</widget>
2932
</item>
3033
<item row="1" column="0">
@@ -64,6 +67,9 @@
6467
<property name="text">
6568
<string>TextLabel</string>
6669
</property>
70+
<property name="textFormat">
71+
<enum>Qt::RichText</enum>
72+
</property>
6773
</widget>
6874
</item>
6975
<item row="3" column="0">
@@ -87,6 +93,9 @@
8793
<property name="text">
8894
<string>TextLabel</string>
8995
</property>
96+
<property name="textFormat">
97+
<enum>Qt::RichText</enum>
98+
</property>
9099
</widget>
91100
</item>
92101
<item row="5" column="0">

‎src/gui/authenticationdialog.cpp

+1
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ AuthenticationDialog::AuthenticationDialog(const QString &realm, const QString &
3030
setWindowTitle(tr("Authentication Required"));
3131
QVBoxLayout *lay = new QVBoxLayout(this);
3232
QLabel *label = new QLabel(tr("Enter username and password for '%1' at %2.").arg(realm, domain));
33+
label->setTextFormat(Qt::PlainText);
3334
lay->addWidget(label);
3435

3536
QFormLayout *form = new QFormLayout;

‎src/gui/folder.cpp

+4-4
Original file line numberDiff line numberDiff line change
@@ -383,16 +383,16 @@ void Folder::createGuiLog( const QString& filename, LogStatus status, int count,
383383
break;
384384
case LogStatusRename:
385385
if( count > 1 ) {
386-
text = tr("%1 has been renamed to %2 and %n other file(s) have been renamed.", "", count-1).arg(file).arg(renameTarget);
386+
text = tr("%1 has been renamed to %2 and %n other file(s) have been renamed.", "", count-1).arg(file, renameTarget);
387387
} else {
388-
text = tr("%1 has been renamed to %2.", "%1 and %2 name files.").arg(file).arg(renameTarget);
388+
text = tr("%1 has been renamed to %2.", "%1 and %2 name files.").arg(file, renameTarget);
389389
}
390390
break;
391391
case LogStatusMove:
392392
if( count > 1 ) {
393-
text = tr("%1 has been moved to %2 and %n other file(s) have been moved.", "", count-1).arg(file).arg(renameTarget);
393+
text = tr("%1 has been moved to %2 and %n other file(s) have been moved.", "", count-1).arg(file, renameTarget);
394394
} else {
395-
text = tr("%1 has been moved to %2.").arg(file).arg(renameTarget);
395+
text = tr("%1 has been moved to %2.").arg(file, renameTarget);
396396
}
397397
break;
398398
case LogStatusConflict:

‎src/gui/folderstatusmodel.cpp

+2-1
Original file line numberDiff line numberDiff line change
@@ -164,10 +164,11 @@ QVariant FolderStatusModel::data(const QModelIndex &index, int role) const
164164
{
165165
const auto &x = static_cast<SubFolderInfo *>(index.internalPointer())->_subs[index.row()];
166166
switch (role) {
167-
case Qt::ToolTipRole:
168167
case Qt::DisplayRole:
169168
//: Example text: "File.txt (23KB)"
170169
return x._size < 0 ? x._name : tr("%1 (%2)").arg(x._name, Utility::octetsToString(x._size));
170+
case Qt::ToolTipRole:
171+
return QString(QLatin1String("<qt>") + Utility::escape(x._size < 0 ? x._name : tr("%1 (%2)").arg(x._name, Utility::octetsToString(x._size))) + QLatin1String("</qt>"));
171172
case Qt::CheckStateRole:
172173
return x._checked;
173174
case Qt::DecorationRole:

‎src/gui/folderwizard.cpp

+3-2
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ FolderWizardLocalPath::FolderWizardLocalPath(const AccountPtr& account)
6565
connect(_ui.localFolderChooseBtn, SIGNAL(clicked()), this, SLOT(slotChooseLocalFolder()));
6666
_ui.localFolderChooseBtn->setToolTip(tr("Click to select a local folder to sync."));
6767

68-
QString defaultPath = QString::fromLatin1( "%1/%2").arg( QDir::homePath() ).arg(Theme::instance()->appName() );
68+
QString defaultPath = QDir::homePath() + QLatin1Char('/') + Theme::instance()->appName();
6969
_ui.localFolderLineEdit->setText( QDir::toNativeSeparators( defaultPath ) );
7070
_ui.localFolderLineEdit->setToolTip(tr("Enter the path to the local folder."));
7171

@@ -441,7 +441,8 @@ bool FolderWizardRemotePath::isComplete() const
441441
if (QDir::cleanPath(dir) == QDir::cleanPath(curDir)) {
442442
warnStrings.append(tr("This folder is already being synced."));
443443
} else if (dir.startsWith(curDir + QLatin1Char('/'))) {
444-
warnStrings.append(tr("You are already syncing <i>%1</i>, which is a parent folder of <i>%2</i>.").arg(curDir).arg(dir));
444+
warnStrings.append(tr("You are already syncing <i>%1</i>, which is a parent folder of <i>%2</i>.").arg(
445+
Utility::escape(curDir), Utility::escape(dir)));
445446
}
446447

447448
if (curDir == QLatin1String("/")) {

‎src/gui/folderwizardsourcepage.ui

+1-1
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@
126126
<string/>
127127
</property>
128128
<property name="textFormat">
129-
<enum>Qt::AutoText</enum>
129+
<enum>Qt::RichText</enum>
130130
</property>
131131
<property name="margin">
132132
<number>3</number>

‎src/gui/folderwizardtargetpage.ui

+1-1
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@
110110
<string>TextLabel</string>
111111
</property>
112112
<property name="textFormat">
113-
<enum>Qt::AutoText</enum>
113+
<enum>Qt::RichText</enum>
114114
</property>
115115
<property name="wordWrap">
116116
<bool>true</bool>

‎src/gui/owncloudsetuppage.ui

+6
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@
3535
<property name="text">
3636
<string>TextLabel</string>
3737
</property>
38+
<property name="textFormat">
39+
<enum>Qt::RichText</enum>
40+
</property>
3841
</widget>
3942
</item>
4043
<item row="3" column="0" colspan="2">
@@ -155,6 +158,9 @@
155158
<property name="text">
156159
<string>TextLabel</string>
157160
</property>
161+
<property name="textFormat">
162+
<enum>Qt::RichText</enum>
163+
</property>
158164
</widget>
159165
</item>
160166
<item row="5" column="1">

‎src/gui/owncloudsetupwizard.cpp

+23-19
Original file line numberDiff line numberDiff line change
@@ -178,10 +178,10 @@ void OwncloudSetupWizard::slotOwnCloudFoundAuth(const QUrl& url, const QVariantM
178178
auto serverVersion = CheckServerJob::version(info);
179179

180180
_ocWizard->appendToConfigurationLog(tr("<font color=\"green\">Successfully connected to %1: %2 version %3 (%4)</font><br/><br/>")
181-
.arg(url.toString())
182-
.arg(Theme::instance()->appNameGUI())
183-
.arg(CheckServerJob::versionString(info))
184-
.arg(serverVersion));
181+
.arg(Utility::escape(url.toString()),
182+
Utility::escape(Theme::instance()->appNameGUI()),
183+
Utility::escape(CheckServerJob::versionString(info)),
184+
Utility::escape(serverVersion)));
185185

186186
_ocWizard->account()->setServerVersion(serverVersion);
187187

@@ -212,9 +212,9 @@ void OwncloudSetupWizard::slotNoOwnCloudFoundAuth(QNetworkReply *reply)
212212
msg = tr("Invalid URL");
213213
} else {
214214
msg = tr("Failed to connect to %1 at %2:<br/>%3")
215-
.arg(Theme::instance()->appNameGUI(),
216-
reply->url().toString(),
217-
reply->errorString());
215+
.arg(Utility::escape(Theme::instance()->appNameGUI()),
216+
Utility::escape(reply->url().toString()),
217+
Utility::escape(reply->errorString()));
218218
}
219219
bool isDowngradeAdvised = checkDowngradeAdvised(reply);
220220

@@ -244,9 +244,10 @@ void OwncloudSetupWizard::slotNoOwnCloudFoundAuth(QNetworkReply *reply)
244244

245245
void OwncloudSetupWizard::slotNoOwnCloudFoundAuthTimeout(const QUrl&url)
246246
{
247-
_ocWizard->displayError(tr("Timeout while trying to connect to %1 at %2.")
248-
.arg(Theme::instance()->appNameGUI(),
249-
url.toString()), false);
247+
_ocWizard->displayError(
248+
tr("Timeout while trying to connect to %1 at %2.")
249+
.arg(Utility::escape(Theme::instance()->appNameGUI()), Utility::escape(url.toString())),
250+
false);
250251
}
251252

252253
void OwncloudSetupWizard::slotConnectToOCUrl( const QString& url )
@@ -307,7 +308,7 @@ void OwncloudSetupWizard::slotAuthError()
307308
}
308309
errorMsg = tr("The authenticated request to the server was redirected to "
309310
"'%1'. The URL is bad, the server is misconfigured.")
310-
.arg(redirectUrl.toString());
311+
.arg(Utility::escape(redirectUrl.toString()));
311312

312313
// A 404 is actually a success: we were authorized to know that the folder does
313314
// not exist. It will be created later...
@@ -320,7 +321,7 @@ void OwncloudSetupWizard::slotAuthError()
320321
if (!_ocWizard->account()->credentials()->stillValid(reply)) {
321322
errorMsg = tr("Access forbidden by server. To verify that you have proper access, "
322323
"<a href=\"%1\">click here</a> to access the service with your browser.")
323-
.arg(_ocWizard->account()->url().toString());
324+
.arg(Utility::escape(_ocWizard->account()->url().toString()));
324325
} else {
325326
errorMsg = errorMessage(reply->errorString(), reply->readAll());
326327
}
@@ -369,7 +370,9 @@ void OwncloudSetupWizard::slotCreateLocalAndRemoteFolders(const QString& localFo
369370
if( fi.exists() ) {
370371
// there is an existing local folder. If its non empty, it can only be synced if the
371372
// ownCloud is newly created.
372-
_ocWizard->appendToConfigurationLog( tr("Local sync folder %1 already exists, setting it up for sync.<br/><br/>").arg(localFolder));
373+
_ocWizard->appendToConfigurationLog(
374+
tr("Local sync folder %1 already exists, setting it up for sync.<br/><br/>")
375+
.arg(Utility::escape(localFolder)));
373376
} else {
374377
QString res = tr("Creating local sync folder %1...").arg(localFolder);
375378
if( fi.mkpath( localFolder ) ) {
@@ -379,7 +382,7 @@ void OwncloudSetupWizard::slotCreateLocalAndRemoteFolders(const QString& localFo
379382
} else {
380383
res += tr("failed.");
381384
qDebug() << "Failed to create " << fi.path();
382-
_ocWizard->displayError(tr("Could not create local folder %1").arg(localFolder), false);
385+
_ocWizard->displayError(tr("Could not create local folder %1").arg(Utility::escape(localFolder)), false);
383386
nextStep = false;
384387
}
385388
_ocWizard->appendToConfigurationLog( res );
@@ -415,7 +418,7 @@ void OwncloudSetupWizard::slotRemoteFolderExists(QNetworkReply *reply)
415418
}
416419

417420
if( !ok ) {
418-
_ocWizard->displayError(error, false);
421+
_ocWizard->displayError(Utility::escape(error), false);
419422
}
420423

421424
finalizeSetup( ok );
@@ -455,8 +458,8 @@ void OwncloudSetupWizard::slotCreateRemoteFolderFinished( QNetworkReply::Network
455458
_remoteFolder.clear();
456459
success = false;
457460
} else {
458-
_ocWizard->appendToConfigurationLog( tr("Remote folder %1 creation failed with error <tt>%2</tt>.").arg(_remoteFolder).arg(error));
459-
_ocWizard->displayError( tr("Remote folder %1 creation failed with error <tt>%2</tt>.").arg(_remoteFolder).arg(error), false );
461+
_ocWizard->appendToConfigurationLog( tr("Remote folder %1 creation failed with error <tt>%2</tt>.").arg(Utility::escape(_remoteFolder)).arg(error));
462+
_ocWizard->displayError( tr("Remote folder %1 creation failed with error <tt>%2</tt>.").arg(Utility::escape(_remoteFolder)).arg(error), false );
460463
_remoteFolder.clear();
461464
success = false;
462465
}
@@ -472,8 +475,9 @@ void OwncloudSetupWizard::finalizeSetup( bool success )
472475
const QString localFolder = _ocWizard->property("localFolder").toString();
473476
if( success ) {
474477
if( !(localFolder.isEmpty() || _remoteFolder.isEmpty() )) {
475-
_ocWizard->appendToConfigurationLog( tr("A sync connection from %1 to remote directory %2 was set up.")
476-
.arg(localFolder).arg(_remoteFolder));
478+
_ocWizard->appendToConfigurationLog(
479+
tr("A sync connection from %1 to remote directory %2 was set up.")
480+
.arg(localFolder, _remoteFolder));
477481
}
478482
_ocWizard->appendToConfigurationLog( QLatin1String(" "));
479483
_ocWizard->appendToConfigurationLog( QLatin1String("<p><font color=\"green\"><b>")

‎src/gui/protocolwidget.ui

+3
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@
1919
<property name="text">
2020
<string>TextLabel</string>
2121
</property>
22+
<property name="textFormat">
23+
<enum>Qt::PlainText</enum>
24+
</property>
2225
</widget>
2326
</item>
2427
<item row="1" column="0" colspan="2">

‎src/gui/proxyauthdialog.ui

+3
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,9 @@
7373
<property name="text">
7474
<string>TextLabel</string>
7575
</property>
76+
<property name="textFormat">
77+
<enum>Qt::PlainText</enum>
78+
</property>
7679
</widget>
7780
</item>
7881
</layout>

‎src/gui/proxyauthhandler.cpp

+1-2
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,7 @@ void ProxyAuthHandler::handleProxyAuthenticationRequired(
5858
return;
5959
}
6060

61-
QString key = QString::fromLatin1("%1:%2").arg(
62-
proxy.hostName(), QString::number(proxy.port()));
61+
QString key = proxy.hostName() + QLatin1Char(':') + QString::number(proxy.port());
6362

6463
// If the proxy server has changed, forget what we know.
6564
if (key != _proxy) {

‎src/gui/settingsdialog.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -252,7 +252,7 @@ void SettingsDialog::customizeStyle()
252252
QString altBase(palette().alternateBase().color().name());
253253
QString dark(palette().dark().color().name());
254254
QString background(palette().base().color().name());
255-
_toolBar->setStyleSheet(QString::fromAscii(TOOLBAR_CSS).arg(background).arg(dark).arg(highlightColor).arg(altBase));
255+
_toolBar->setStyleSheet(QString::fromAscii(TOOLBAR_CSS).arg(background,dark,highlightColor,altBase));
256256

257257
Q_FOREACH(QAction *a, _actionGroup->actions()) {
258258
QIcon icon = createColorAwareIcon(a->property("iconPath").toString());

‎src/gui/sharedialog.ui

+6
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@
2727
<property name="text">
2828
<string>share label</string>
2929
</property>
30+
<property name="textFormat">
31+
<enum>Qt::PlainText</enum>
32+
</property>
3033
</widget>
3134
</item>
3235
<item row="1" column="1">
@@ -46,6 +49,9 @@
4649
<property name="text">
4750
<string>ownCloud Path:</string>
4851
</property>
52+
<property name="textFormat">
53+
<enum>Qt::PlainText</enum>
54+
</property>
4955
</widget>
5056
</item>
5157
<item row="0" column="0" rowspan="2">

‎src/gui/sharelinkwidget.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -321,7 +321,7 @@ void ShareLinkWidget::redrawElidedUrl()
321321
const QUrl realUrl(_shareUrl);
322322
QString elidedUrl = fm.elidedText(_shareUrl, Qt::ElideRight, linkLengthPixel);
323323

324-
u = QString("<a href=\"%1\">%2</a>").arg(realUrl.toString(QUrl::None)).arg(elidedUrl);
324+
u = QString("<a href=\"%1\">%2</a>").arg(Utility::escape(realUrl.toString(QUrl::None)), Utility::escape(elidedUrl));
325325
}
326326
_ui->_labelShareLink->setText(u);
327327
}

0 commit comments

Comments
 (0)
Please sign in to comment.