[xiphos-source] [crosswire/xiphos] e67e98: ipc: fix D-Bus action denylist bypass via URL path...

[Acts1631]

  Branch: refs/heads/master
  Home:   https://github.com/crosswire/xiphos
  Commit: e67e982aef2b4824a8e7d9fc430afb130f94b786
      https://github.com/crosswire/xiphos/commit/e67e982aef2b4824a8e7d9fc430afb130f94b786
  Author: Acts1631 <69813585+acts-1631 at users.noreply.github.com>
  Date:   2026-07-09 (Thu, 09 Jul 2026)

  Changed paths:
    M src/gtk/ipc.c
    M src/main/url.cc
    M src/main/url.hh

  Log Message:
  -----------
  ipc: fix D-Bus action denylist bypass via URL path/query ambiguity (#1343)

ipc_object_set_current_reference() rejects setCurrentReference calls
that request the showStudypad or showImage actions, since those touch
the local filesystem or spawn external programs and the D-Bus session
bus is reachable by any local peer.

The check extracted the action value with strstr(reference, "action=")
on the raw reference, but main_url_handler() splits the URL at the
first '?' and asks Sword's URL class to parse the action from the
query string only. A reference such as

  passagestudy.jsp/action=showBookmark?action=showImage&value=evil.png

has "action=showBookmark" appear first in the URL path, so the raw
strstr() picks that up (and it doesn't match the denylist), while
Sword's parser only looks at the query string after the '?' and
resolves the real action to showImage, which then gets dispatched.

Fix this by not re-implementing URL/query parsing a second time in
ipc.c. Factor the re-encoding + Sword URL parsing that
main_url_handler() already uses for dispatch into
main_url_get_action(), and have the IPC gate call that instead. The
check and the actual dispatch now always agree, since they're the same
code path, so this class of parsing-asymmetry bypass isn't possible
regardless of how the URL is structured.



To unsubscribe from these emails, change your notification settings at https://github.com/crosswire/xiphos/settings/notifications