Merge pull request #4577

23ec5eb qml: escape untrusted text in RichText views (selsta)

CMakeLists.txt

@@ -5,7 +5,7 @@ message(STATUS "Initiating compile using CMake ${CMAKE_VERSION}")
 
 set(VERSION_MAJOR "18")
 set(VERSION_MINOR "4")
-set(VERSION_REVISION "6")
+set(VERSION_REVISION "7")
 set(VERSION "0.${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_REVISION}")
 
 option(STATIC "Link libraries statically, requires static Qt")

README.md

@@ -105,7 +105,7 @@ Packaging for your favorite distribution would be a welcome contribution!
    ```
    git clone --branch master --recursive https://github.com/monero-project/monero-gui.git
    ```
-   \* `master` - replace with the desired version tag (e.g. `v0.18.4.6`) to build the release binaries.
+   \* `master` - replace with the desired version tag (e.g. `v0.18.4.7`) to build the release binaries.
 3. Prepare build environment
    ```
    cd monero-gui
@@ -128,7 +128,7 @@ Packaging for your favorite distribution would be a welcome contribution!
    ```
    git clone --branch master --recursive https://github.com/monero-project/monero-gui.git
    ```
-   \* `master` - replace with the desired version tag (e.g. `v0.18.4.6`) to build the release binaries.
+   \* `master` - replace with the desired version tag (e.g. `v0.18.4.7`) to build the release binaries.
 3. Prepare build environment
    ```
    cd monero-gui

components/TxConfirmationDialog.qml

@@ -32,6 +32,7 @@ import QtQuick.Controls 2.2
 import QtQuick.Layouts 1.1
 
 import "../components" as MoneroComponents
+import "../js/Utils.js" as Utils
 import FontAwesome 1.0
 
 Rectangle {
@@ -306,7 +307,7 @@ Rectangle {
                             }
                             var title;
                             if (addressBookName) {
-                                title = FontAwesome.addressBook + " " + addressBookName;
+                                title = FontAwesome.addressBook + " " + Utils.htmlEscape(addressBookName);
                             } else {
                                 title = qsTr("Monero address") + translationManager.emptyString;
                             }

installers/windows/Monero.iss

@@ -56,7 +56,6 @@ Name: "en"; MessagesFile: "compiler:Default.isl"
 
 [Dirs]
 Name: "{app}";
-Name: "{app}\p2pool"; Permissions: users-full
 
 [Files]
 ; The use of the flag "ignoreversion" for the following entries leads to the following behaviour:
@@ -138,6 +137,7 @@ Type: filesandordirs; Name: "{app}\QtQuick.2"
 Type: filesandordirs; Name: "{app}\Material"
 Type: filesandordirs; Name: "{app}\Universal"
 Type: filesandordirs; Name: "{app}\scenegraph"
+Type: filesandordirs; Name: "{localappdata}\monero-core\p2pool"
 Type: filesandordirs; Name: "{app}\p2pool"
 Type: files; Name: "{app}\D3Dcompiler_47.dll"
 Type: files; Name: "{app}\libbz2-1.dll"
@@ -173,6 +173,8 @@ Type: files; Name: "{app}\ssleay32.dll"
 Type: files; Name: "{app}\start-high-dpi.bat"
 Type: files; Name: "{group}\Utilities\x (Check Blockchain Folder).lnk"
 
+[UninstallDelete]
+Type: filesandordirs; Name: "{localappdata}\monero-core\p2pool"
 
 [Tasks]
 Name: desktopicon; Description: "Create a &desktop icon"; GroupDescription: "Additional icons:";

js/Utils.js

@@ -130,3 +130,13 @@ function parseDateStringOrRestoreHeightAsInteger(value) {
     }
     return restoreHeight;
 }
+
+function htmlEscape(s) {
+    if (s === null || s === undefined)
+        return "";
+    return String(s)
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}

main.qml

@@ -445,41 +445,23 @@ ApplicationWindow {
     }
 
     function onUriHandler(uri){
-        if(uri.startsWith("monero://")){
-            var address = uri.substring("monero://".length);
+        if (uri && (uri.startsWith("monero://") || uri.startsWith("monero:"))) {
+            const normalizedUri = uri.replace("monero://", "monero:");
+            const parsed = walletManager.parse_uri_to_object(normalizedUri);
 
-            var params = {}
-            if(address.length === 0) return;
-            var spl = address.split("?");
+            if (parsed.error) {
+                console.log("Invalid Monero URI: " + parsed.error);
+            } else {
+                middlePanel.transferView.sendTo(
+                    parsed.address || "",
+                    parsed.payment_id || "",
+                    parsed.tx_description || "",
+                    parsed.amount || ""
+                );
 
-            if(spl.length > 2) return;
-            if(spl.length >= 1) {
-                // parse additional params
-                address = spl[0];
-
-                if(spl.length === 2){
-                    spl.shift();
-                    var item = spl[0];
-
-                    var _spl = item.split("&");
-                    for (var param in _spl){
-                        var _item = _spl[param];
-                        if(!_item.indexOf("=") > 0) continue;
-
-                        var __spl = _item.split("=");
-                        if(__spl.length !== 2) continue;
-
-                        params[__spl[0]] = __spl[1];
-                    }
-                }
+                appWindow.raise();
+                appWindow.show();
             }
-
-            // Fill fields
-            middlePanel.transferView.sendTo(address, params["tx_payment_id"], params["tx_description"], params["tx_amount"]);
-
-            // Raise window
-            appWindow.raise();
-            appWindow.show();
         }
     }
 

pages/settings/SettingsLog.qml

@@ -180,7 +180,7 @@ Rectangle {
                         consoleArea.append(msg);
                     }
                     function logMessage(msg){
-                        msg = msg.trim();
+                        msg = Utils.htmlEscape(msg.trim());
                         var color = MoneroComponents.Style.defaultFontColor;
                         if(msg.toLowerCase().indexOf('error') >= 0){
                             color = MoneroComponents.Style.errorColor;

src/main/oshelper.h

@@ -56,10 +56,10 @@ public:
     Q_INVOKABLE bool isCapsLock() const;
     Q_INVOKABLE quint8 getNetworkTypeFromFile(const QString &keysPath) const;
     Q_INVOKABLE void openSeedTemplate() const;
+    bool installed() const;
 
     static std::pair<quint8, QString> getNetworkTypeAndAddressFromFile(const QString &wallet);
 private:
-    bool installed() const;
 
 signals:
 

src/p2pool/P2PoolManager.cpp

@@ -29,6 +29,7 @@
 #include "P2PoolManager.h"
 #include "net/http_client.h"
 #include "common/util.h"
+#include "main/oshelper.h"
 #include "qt/utils.h"
 #include <QElapsedTimer>
 #include <QFile>
@@ -41,6 +42,7 @@
 #include <QApplication>
 #include <QProcess>
 #include <QMap>
+#include <QStandardPaths>
 #include <QCryptographicHash>
 
 #if defined(Q_OS_MACOS) && defined(__aarch64__) && !defined(Q_OS_MACOS_AARCH64)
@@ -53,21 +55,21 @@ void P2PoolManager::download() {
         QString fileName;
         QString validHash;
         #ifdef Q_OS_WIN
-            url = "https://github.com/SChernykh/p2pool/releases/download/v4.13/p2pool-v4.13-windows-x64.zip";
-            fileName = m_p2poolPath + "/p2pool-v4.13-windows-x64.zip";
-            validHash = "267006cd1259253052e64e9ac5ae27532cf238e71588444c14624b9432325e9f";
+            url = "https://github.com/SChernykh/p2pool/releases/download/v4.14/p2pool-v4.14-windows-x64.zip";
+            fileName = m_p2poolPath + "/p2pool-v4.14-windows-x64.zip";
+            validHash = "9c7f0476c441fc0c021fae7d01264b4ec61dc3301ed73b65931555550becf396";
         #elif defined(Q_OS_LINUX)
-            url = "https://github.com/SChernykh/p2pool/releases/download/v4.13/p2pool-v4.13-linux-x64.tar.gz";
-            fileName = m_p2poolPath + "/p2pool-v4.13-linux-x64.tar.gz";
-            validHash = "d02361ee5f18e3e53af79436af6dc1772b71aa5ad8582ad88b0764ae2c9289c3";
+            url = "https://github.com/SChernykh/p2pool/releases/download/v4.14/p2pool-v4.14-linux-x64.tar.gz";
+            fileName = m_p2poolPath + "/p2pool-v4.14-linux-x64.tar.gz";
+            validHash = "e64f6f774dc35352b8ae4397ccdb92ce0cc935cdfb100eac58d44e49f8796a01";
         #elif defined(Q_OS_MACOS_AARCH64)
-            url = "https://github.com/SChernykh/p2pool/releases/download/v4.13/p2pool-v4.13-macos-aarch64.tar.gz";
-            fileName = m_p2poolPath + "/p2pool-v4.13-macos-aarch64.tar.gz";
-            validHash = "fddd309566395a8297738f3fd5cd0fe9d792c3005bb664a1a61befa029e802ad";
+            url = "https://github.com/SChernykh/p2pool/releases/download/v4.14/p2pool-v4.14-macos-aarch64.tar.gz";
+            fileName = m_p2poolPath + "/p2pool-v4.14-macos-aarch64.tar.gz";
+            validHash = "7cc780af6115ef8d9d6b7f3c1336f57dab25745b6208b6e97dca8729782e155b";
         #elif defined(Q_OS_MACOS)
-            url = "https://github.com/SChernykh/p2pool/releases/download/v4.13/p2pool-v4.13-macos-x64.tar.gz";
-            fileName = m_p2poolPath + "/p2pool-v4.13-macos-x64.tar.gz";
-            validHash = "374c42bbb409ed2ef3e5e0b4359441929cc574b2fa9bc8b3bdf7695471f8f94d";
+            url = "https://github.com/SChernykh/p2pool/releases/download/v4.14/p2pool-v4.14-macos-x64.tar.gz";
+            fileName = m_p2poolPath + "/p2pool-v4.14-macos-x64.tar.gz";
+            validHash = "7df3be2ae15eda4260d2665e4a2c3c7dc2f1dba26a2a643e46a2b1283097a60a";
         #endif
         QFile file(fileName);
         epee::net_utils::http::http_simple_client http_client;
@@ -241,9 +243,14 @@ P2PoolManager::P2PoolManager(QObject *parent)
     started = false;
     // Platform dependent path to p2pool
 #ifdef Q_OS_WIN
-    m_p2poolPath = QApplication::applicationDirPath() + "/p2pool";
+    if (OSHelper().installed()) {
+        m_p2poolPath = QStandardPaths::writableLocation(QStandardPaths::AppLocalDataLocation) + "/p2pool";
+    } else {
+        m_p2poolPath = QApplication::applicationDirPath() + "/p2pool";
+    }
+
     if (!QDir(m_p2poolPath).exists()) {
-        QDir().mkdir(m_p2poolPath);
+        QDir().mkpath(m_p2poolPath);
     }
     m_p2pool = m_p2poolPath + "/p2pool.exe";
 #elif defined(Q_OS_UNIX)

wizard/WizardController.qml

@@ -378,9 +378,6 @@ Rectangle {
             console.log("Removing temporary wallet: " + wizardController.tmpWalletFilename)
             oshelper.removeTemporaryWallet(wizardController.tmpWalletFilename)
 
-            // protecting wallet with password
-            wizardController.m_wallet.setPassword(wizardController.walletOptionsPassword);
-
             // save to persistent settings
             persistentSettings.account_name = wizardController.walletOptionsName
             persistentSettings.wallet_path = wizardController.m_wallet.path;
@@ -399,6 +396,7 @@ Rectangle {
             new_wallet_filename = appWindow.accountsDir + new_wallet_filename;
         }
         console.log("saving new wallet to", new_wallet_filename);
+        wizardController.m_wallet.setPassword(wizardController.walletOptionsPassword);
         wizardController.m_wallet.storeAsync(handler, new_wallet_filename);
     }