Merge pull request #4577

23ec5eb qml: escape untrusted text in RichText views (selsta)

components/TxConfirmationDialog.qml

@@ -32,6 +32,7 @@ import QtQuick.Controls 2.2
 import QtQuick.Layouts 1.1
 
 import "../components" as MoneroComponents
+import "../js/Utils.js" as Utils
 import FontAwesome 1.0
 
 Rectangle {
@@ -306,7 +307,7 @@ Rectangle {
                             }
                             var title;
                             if (addressBookName) {
-                                title = FontAwesome.addressBook + " " + addressBookName;
+                                title = FontAwesome.addressBook + " " + Utils.htmlEscape(addressBookName);
                             } else {
                                 title = qsTr("Monero address") + translationManager.emptyString;
                             }

installers/windows/Monero.iss

@@ -56,7 +56,6 @@ Name: "en"; MessagesFile: "compiler:Default.isl"
 
 [Dirs]
 Name: "{app}";
-Name: "{app}\p2pool"; Permissions: users-full
 
 [Files]
 ; The use of the flag "ignoreversion" for the following entries leads to the following behaviour:
@@ -138,6 +137,7 @@ Type: filesandordirs; Name: "{app}\QtQuick.2"
 Type: filesandordirs; Name: "{app}\Material"
 Type: filesandordirs; Name: "{app}\Universal"
 Type: filesandordirs; Name: "{app}\scenegraph"
+Type: filesandordirs; Name: "{localappdata}\monero-core\p2pool"
 Type: filesandordirs; Name: "{app}\p2pool"
 Type: files; Name: "{app}\D3Dcompiler_47.dll"
 Type: files; Name: "{app}\libbz2-1.dll"
@@ -173,6 +173,8 @@ Type: files; Name: "{app}\ssleay32.dll"
 Type: files; Name: "{app}\start-high-dpi.bat"
 Type: files; Name: "{group}\Utilities\x (Check Blockchain Folder).lnk"
 
+[UninstallDelete]
+Type: filesandordirs; Name: "{localappdata}\monero-core\p2pool"
 
 [Tasks]
 Name: desktopicon; Description: "Create a &desktop icon"; GroupDescription: "Additional icons:";

js/Utils.js

@@ -130,3 +130,13 @@ function parseDateStringOrRestoreHeightAsInteger(value) {
     }
     return restoreHeight;
 }
+
+function htmlEscape(s) {
+    if (s === null || s === undefined)
+        return "";
+    return String(s)
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}

main.qml

@@ -445,41 +445,23 @@ ApplicationWindow {
     }
 
     function onUriHandler(uri){
-        if(uri.startsWith("monero://")){
-            var address = uri.substring("monero://".length);
+        if (uri && (uri.startsWith("monero://") || uri.startsWith("monero:"))) {
+            const normalizedUri = uri.replace("monero://", "monero:");
+            const parsed = walletManager.parse_uri_to_object(normalizedUri);
 
-            var params = {}
-            if(address.length === 0) return;
-            var spl = address.split("?");
+            if (parsed.error) {
+                console.log("Invalid Monero URI: " + parsed.error);
+            } else {
+                middlePanel.transferView.sendTo(
+                    parsed.address || "",
+                    parsed.payment_id || "",
+                    parsed.tx_description || "",
+                    parsed.amount || ""
+                );
 
-            if(spl.length > 2) return;
-            if(spl.length >= 1) {
-                // parse additional params
-                address = spl[0];
-
-                if(spl.length === 2){
-                    spl.shift();
-                    var item = spl[0];
-
-                    var _spl = item.split("&");
-                    for (var param in _spl){
-                        var _item = _spl[param];
-                        if(!_item.indexOf("=") > 0) continue;
-
-                        var __spl = _item.split("=");
-                        if(__spl.length !== 2) continue;
-
-                        params[__spl[0]] = __spl[1];
-                    }
-                }
+                appWindow.raise();
+                appWindow.show();
             }
-
-            // Fill fields
-            middlePanel.transferView.sendTo(address, params["tx_payment_id"], params["tx_description"], params["tx_amount"]);
-
-            // Raise window
-            appWindow.raise();
-            appWindow.show();
         }
     }
 

pages/settings/SettingsLog.qml

@@ -180,7 +180,7 @@ Rectangle {
                         consoleArea.append(msg);
                     }
                     function logMessage(msg){
-                        msg = msg.trim();
+                        msg = Utils.htmlEscape(msg.trim());
                         var color = MoneroComponents.Style.defaultFontColor;
                         if(msg.toLowerCase().indexOf('error') >= 0){
                             color = MoneroComponents.Style.errorColor;

src/main/oshelper.h

@@ -56,10 +56,10 @@ public:
     Q_INVOKABLE bool isCapsLock() const;
     Q_INVOKABLE quint8 getNetworkTypeFromFile(const QString &keysPath) const;
     Q_INVOKABLE void openSeedTemplate() const;
+    bool installed() const;
 
     static std::pair<quint8, QString> getNetworkTypeAndAddressFromFile(const QString &wallet);
 private:
-    bool installed() const;
 
 signals:
 

src/p2pool/P2PoolManager.cpp

@@ -29,6 +29,7 @@
 #include "P2PoolManager.h"
 #include "net/http_client.h"
 #include "common/util.h"
+#include "main/oshelper.h"
 #include "qt/utils.h"
 #include <QElapsedTimer>
 #include <QFile>
@@ -41,6 +42,7 @@
 #include <QApplication>
 #include <QProcess>
 #include <QMap>
+#include <QStandardPaths>
 #include <QCryptographicHash>
 
 #if defined(Q_OS_MACOS) && defined(__aarch64__) && !defined(Q_OS_MACOS_AARCH64)
@@ -241,9 +243,14 @@ P2PoolManager::P2PoolManager(QObject *parent)
     started = false;
     // Platform dependent path to p2pool
 #ifdef Q_OS_WIN
-    m_p2poolPath = QApplication::applicationDirPath() + "/p2pool";
+    if (OSHelper().installed()) {
+        m_p2poolPath = QStandardPaths::writableLocation(QStandardPaths::AppLocalDataLocation) + "/p2pool";
+    } else {
+        m_p2poolPath = QApplication::applicationDirPath() + "/p2pool";
+    }
+
     if (!QDir(m_p2poolPath).exists()) {
-        QDir().mkdir(m_p2poolPath);
+        QDir().mkpath(m_p2poolPath);
     }
     m_p2pool = m_p2poolPath + "/p2pool.exe";
 #elif defined(Q_OS_UNIX)