[xiphos-source] [crosswire/xiphos] 61afde: security: fix buffer overflow and HTML injection i...

[Acts1631]

  Branch: refs/heads/master
  Home:   https://github.com/crosswire/xiphos
  Commit: 61afdeb29386c47e52de6328abe54e75c50ee85f
      https://github.com/crosswire/xiphos/commit/61afdeb29386c47e52de6328abe54e75c50ee85f
  Author: Acts1631 <69813585+acts-1631 at users.noreply.github.com>
  Date:   2026-07-09 (Thu, 09 Jul 2026)

  Changed paths:
    M src/gtk/export_bookmarks.c

  Log Message:
  -----------
  security: fix buffer overflow and HTML injection in bookmark export (#1345)

Five sprintf() calls wrote filenames into a 256-byte stack buffer using
data->filename, which comes from gtk_file_chooser_get_filename() and can
be up to PATH_MAX (4096 on Linux). A path longer than 251 chars
overflowed the buffer when the extension was appended. The affected
functions are _save_verselist_2_xml, _save_verselist_2_html (both .html
and .txt branches), save_iter_to_xml, and _save_iter (both branches).
export_2_html also had a dead sprintf into a 256-byte buffer whose
result was never read but still corrupted the stack. Replaced all fixed
buffers with g_strdup_printf() allocations and freed them after use;
removed the dead code in export_2_html.

Bookmark description, module, key, folder caption, and search-result
title were inserted verbatim into exported HTML output, allowing stored
XSS when the exported file is opened in a browser. A bookmark
description like </li></ul><script>...</script> would execute on view.
Escape these user-controlled values with g_markup_escape_text() before
formatting them into HTML. The affected locations are gui_set_html_item,
_parse_treeview (folder caption), _save_iter (HTML header caption), and
_save_verselist_2_html (search result title). Rendered scripture text is
left unescaped, as it is legitimate HTML produced by the SWORD render
filters.



To unsubscribe from these emails, change your notification settings at https://github.com/crosswire/xiphos/settings/notifications