| 611 | } |
| 612 | |
| 613 | void showSampleUpdateDialog() |
| 614 | { |
| 615 | obs_log(LOG_DEBUG, "+showSampleUpdateDialog()"); |
| 616 | |
| 617 | if (isUpdatePendingOrShowing()) { |
| 618 | if (update_dialog) { |
| 619 | update_dialog->raise(); |
| 620 | } |
| 621 | obs_log(LOG_DEBUG, "showSampleUpdateDialog: update pending or showing; ignoring"); |
| 622 | return; |
| 623 | } |
| 624 | |
| 625 | // Deliberately hostile content exercising every shape that could slip |
| 626 | // past setMarkdown() if releaseNotes weren't HTML-escaped first: |
| 627 | // raw tags, event-handler attributes, javascript: URLs, ampersand / |
| 628 | // quote edge cases, angle brackets inside code, plus benign markdown |
| 629 | // so we can confirm ordinary formatting still renders. |
| 630 | QString sampleNotes = QStringLiteral( |
| 631 | "# Sample release notes (HOSTILE INPUT)\n" |
| 632 | "\n" |
| 633 | "This dialog is shown only when OBS is launched with\n" |
| 634 | "`--distroav-debug`.\n" |
| 635 | "\n" |
| 636 | "## Script injection attempts\n" |
| 637 | "\n" |
| 638 | "- `<script>alert('xss-script')</script>`\n" |
| 639 | "- `<img src=x onerror=\"alert('xss-img')\">`\n" |
| 640 | "- `<h1 onclick=\"alert('xss-onclick')\">click me</h1>`\n" |
| 641 | "- `<iframe src=\"javascript:alert('xss-iframe')\"></iframe>`\n" |
| 642 | "- `<style>body{background:red}</style>`\n" |
| 643 | "- `<a href=\"javascript:alert('xss-link')\">inline js link</a>`\n" |
| 644 | "\n" |
| 645 | "And the same *unfenced* (they should all appear as literal text,\n" |
| 646 | "not executed / not rendered as HTML):\n" |
| 647 | "\n" |
| 648 | "<script>alert('xss-script-raw')</script>\n" |
| 649 | "<img src=x onerror=\"alert('xss-img-raw')\">\n" |
| 650 | "<h1 onclick=\"alert('xss-onclick-raw')\">raw-h1</h1>\n" |
| 651 | "<iframe src=\"javascript:alert('xss-iframe-raw')\"></iframe>\n" |
| 652 | "\n" |
| 653 | "## Markdown with hostile URLs\n" |
| 654 | "\n" |
| 655 | "- [javascript link](javascript:alert('xss-md-link'))\n" |
| 656 | "- [data-uri link](data:text/html,<script>alert(1)</script>)\n" |
| 657 | "- Autolink: <javascript:alert('xss-autolink')>\n" |
| 658 | "\n" |
| 659 | "## Character edge cases\n" |
| 660 | "\n" |
| 661 | "Ampersands and entities: `&` `&` `<` `>` `"` `'` \n" |
| 662 | "Quotes: `\"` `'` `` ` `` Angle brackets: `<` `>` Backslashes: `\\` `\\\\` \n" |
| 663 | "Unicode/emoji sanity: \u00e9 \u00f1 \u4e2d\u6587 \U0001F680 \U0001F525 \n" |
| 664 | "Chinese (Simplified): \u4e2d\u6587\u6d4b\u8bd5 \u6b22\u8fce\u4f7f\u7528 \u53d1\u5e03\u8bf4\u660e \n" |
| 665 | "Hindi (Devanagari): \u0939\u093f\u0928\u094d\u0926\u0940 \u092a\u0930\u0940\u0915\u094d\u0937\u0923 \u0938\u094d\u0935\u093e\u0917\u0924 \n" |
| 666 | "Thai: \u0e44\u0e17\u0e22 \u0e17\u0e14\u0e2a\u0e2d\u0e1a \u0e22\u0e34\u0e19\u0e14\u0e35\u0e15\u0e49\u0e2d\u0e19\u0e23\u0e31\u0e1a \n" |
| 667 | "\n" |
| 668 | "## Benign markdown (should still format normally)\n" |
| 669 | "\n" |
| 670 | "1. Ordered item\n" |
no test coverage detected