From b09a44173e8671cbf25aff7db73b34f947ed49cf Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Sun, 2 Aug 2026 17:49:48 +0200 Subject: fix: enforce !-free cidPrefix invariant at both concatenation sites The cid: namespacing scheme (cid:!) is only unambiguous because the prefix half is guaranteed free of '!': the first '!' in the result is always the separator, so an attacker-controlled Content-ID containing '!' only extends the id half rather than colliding with a different prefix. That invariant previously existed only as a comment. Add Q_ASSERT_X at both independent call sites that perform this concatenation (CidSchemeHandler::namespacedKey and HtmlBuilder::namespaceCids) so a future prefix generator that violates it traps in debug builds, per Task 5's precedent of not letting one unit's correctness depend silently on another's future behaviour. Since Q_ASSERT compiles out in release, pin the property that actually matters release builds too test: distinct (prefix, id) pairs across a documented "m" prefix set and hostile Content-IDs (containing '!', percent- encoded '!', empty, leading/trailing '!') never collide, and the key always splits at its first '!' back to the exact original prefix. --- src/htmlbuilder.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'src/htmlbuilder.h') diff --git a/src/htmlbuilder.h b/src/htmlbuilder.h index ac24e28..ff62c69 100644 --- a/src/htmlbuilder.h +++ b/src/htmlbuilder.h @@ -16,6 +16,15 @@ struct ThreadRenderItem /// use the same Content-ID (cid:logo@example.org), which would collide in /// a single document, so every reference is rewritten to /// cid:!. + /// + /// Requirement on whatever generates this value: it must never contain + /// '!'. The separator that makes cid:! unambiguous is the + /// FIRST '!' in the namespaced string; that only holds if the prefix + /// half is guaranteed free of the character, since the id half is + /// attacker-controlled and may legitimately contain '!' itself. The + /// documented "m" form (e.g. "m0", "m1") satisfies this. Enforced + /// with Q_ASSERT at both places that perform this concatenation + /// (HtmlBuilder::namespaceCids and CidSchemeHandler::namespacedKey). QString cidPrefix; }; -- cgit v1.2.3