rnhmjoj/qutebrowser
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
6fa07703db
qutebrowser/tests/end2end/data
History
Florian Bruhin 43e58ac865 CVE-2018-10895: Fix CSRF issues with qute://settings/set URL 
In ffc29ee043 (part of v1.0.0), a
qute://settings/set URL was added to change settings.

Contrary to what I apparently believed at the time, it *is* possible for
websites to access `qute://*` URLs (i.e., neither QtWebKit nor QtWebEngine
prohibit such requests, other than the usual cross-origin rules).

In other words, this means a website can e.g. have an `<img>` tag which loads a
`qute://settings/set` URL, which then sets `editor.command` to a bash script.
The result of that is arbitrary code execution.

Fixes #4060
See #2332
2018-07-11 17:05:23 +02:00
..
adblock Add a simple end2end test for :adblock-update 2016-09-07 16:27:27 +02:00
backforward Clean up end2end test file structure 2016-05-29 18:20:00 +02:00
downloads Fix test_mhtml_e2e with Qt 5.11 2018-03-05 11:36:29 +01:00
hints Add test for tab-bg focus 2018-05-09 15:34:01 -07:00
insert_mode_settings/html Try to stabilize test_insert_mode 2016-10-06 10:40:28 +02:00
javascript Improve window_open.html tests 2018-03-25 19:56:48 +02:00
keyinput Clean up end2end test file structure 2016-05-29 18:20:00 +02:00
misc CVE-2018-10895: Fix CSRF issues with qute://settings/set URL 2018-07-11 17:05:23 +02:00
navigate tests navigate: Add tests for rel attributes with nofollow 2017-02-19 12:32:19 +00:00
numbers Update number files 2016-07-26 13:57:35 -04:00
prompt Add more tests for prompts 2016-11-03 08:40:42 +01:00
scroll Set an initial window size for background tabs 2017-06-11 17:48:01 +02:00
sessions Stabilize history.replaceState tests 2017-03-31 13:05:34 +02:00
ssl Clean up end2end test file structure 2016-05-29 18:20:00 +02:00
userscripts Update copyright years 2018-02-05 12:19:50 +01:00
äöü.html Add BDD tests for new history code 2016-06-08 15:15:54 +02:00
caret.html Clean up end2end test file structure 2016-05-29 18:20:00 +02:00
click_element.html Fix :click-element with an ID containing non-alphanumeric characters 2017-12-12 11:33:59 +01:00
data_link.html Don't add data: URLs to history 2017-05-15 09:04:16 +02:00
editor.html tests: Use :click-element in editor.feature 2016-08-18 15:58:40 +02:00
email_address.html Strip mailto: when yanking a hint 2017-01-21 14:43:50 +01:00
hello2.txt Clean up end2end test file structure 2016-05-29 18:20:00 +02:00
hello3.txt Clean up end2end test file structure 2016-05-29 18:20:00 +02:00
hello.txt Clean up end2end test file structure 2016-05-29 18:20:00 +02:00
hinting.txt Clean up end2end test file structure 2016-05-29 18:20:00 +02:00
iframe_search.html Fix several style issues 2018-01-17 17:02:53 -05:00
invalid_link.html Go back to using an invalid scheme for invalid_link.html 2018-06-07 15:30:28 +02:00
issue2569.html Fix crash when clicking <form> element with name="value" child 2018-01-14 20:20:51 +01:00
issue4011.html Fix XSS issue on qute://history 2018-06-21 21:20:19 +02:00
l33t.txt Clean up end2end test file structure 2016-05-29 18:20:00 +02:00
long_load.html Improved zoom level management and enforcement 2017-10-06 20:30:06 -04:00
marks.html BDD: Use :click-element instead of hints 2016-08-18 16:25:58 +02:00
paste_primary.html Stabilize :insert-text tests 2016-09-12 15:25:03 +02:00
reload.txt Clean up end2end test file structure 2016-05-29 18:20:00 +02:00
search_select.js Refactor search method of AbstractBrowserTab into a field 2017-05-09 00:24:13 -07:00
search.html Allow searching for double semicolons 2018-04-05 17:20:50 -04:00
smart.txt Clean up end2end test file structure 2016-05-29 18:20:00 +02:00
title with spaces.html Clean up end2end test file structure 2016-05-29 18:20:00 +02:00
title.html Clean up end2end test file structure 2016-05-29 18:20:00 +02:00
words.txt Clean up end2end test file structure 2016-05-29 18:20:00 +02:00