[xiphos-source] [crosswire/xiphos] 9d4167: fix: reject percent-encoded showStudypad/showImage...

[Devon Kirk]

  Branch: refs/heads/master
  Home:   https://github.com/crosswire/xiphos
  Commit: 9d4167f27e65781eb13f1ca2f2df8f8fc25d459d
      https://github.com/crosswire/xiphos/commit/9d4167f27e65781eb13f1ca2f2df8f8fc25d459d
  Author: Devon Kirk <67167176+hyder365 at users.noreply.github.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    A poc/reproducer.c
    M src/gtk/ipc.c

  Log Message:
  -----------
  fix: reject percent-encoded showStudypad/showImage in D-Bus reference (#1339)

The substring denylist in ipc_object_set_current_reference() runs against
the raw reference bytes before main_url_handler parses the URL.  libsword's
URL::getParameterValue percent-decodes the action parameter, so a reference
like 'passagestudy.jsp?action=show%53tudypad' (or show%49mage for
showImage) contains no literal 'showStudypad'/'showImage' substring,
slips past the denylist, and dispatches the local-file action against
the Xiphos user.

Replace the substring denylist with a percent-decoding of the action
parameter and a direct string compare against the blocked actions.  The
substring allowlist (must contain sword://, bible://, passagestudy.jsp,
or xiphos.url) is kept as a fast pre-filter.

Co-authored-by: Devon Kirk <hyder365 at users.noreply.github.com>



To unsubscribe from these emails, change your notification settings at https://github.com/crosswire/xiphos/settings/notifications