Page MenuHomePhabricator

[backport] gui: Show messages as text not html
ClosedPublic

Authored by majcosta on Dec 18 2019, 20:25.

Details

Reviewers
deadalnix
Fabien
Group Reviewers
Restricted Owners Package(Owns No Changed Paths)
Restricted Project
Commits
rSTAGING3a6fe217920a: [backport] gui: Show messages as text not html
rABC3a6fe217920a: [backport] gui: Show messages as text not html
Summary

6fbc0986f gui: Show messages as text not html (Wladimir J. van der Laan)


Pull request description:

Currently, error messages (such as InitError) are displayed as-is, which means Qt does auto detection on the format.

This means that it's possible to inject HTML from the command line though e.g. specifying a wallet name with HTML in it. This isn't a direct security risk because fetching content from internet is disabled (and as far as I know we never report strings received from the network this way). However, it can be confusing.

So explicitly force the format as text.


This is a backport from Core PR12617 (https://github.com/bitcoin/bitcoin/pull/12617)

Test Plan
ninja check

Diff Detail

Repository
rABC Bitcoin ABC
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.