Address field not sanitized

[Víctor R. Ruiz]

While testing the fix for #1390110, I did this:

- Open webbrowser
- Go to http://m.xataka.com/analisis/asi-es-la-experiencia-ubuntu-en-smartphones-toma-de-contacto-con-el-bq-aquaris-e4-5-ubuntu-edition
- Select all content.
- Go to address book.
- Create a new contact
- Fill name ("Tester").
- Add address field.
- Paste content.
- Save contact.

Expected result:
- Address field shows only text content.

Actual result:
- An images from the webpage is displayed (see attached screenshot).

current build number: 233
device name: krillin
channel: ubuntu-touch/ubuntu-rtm/14.09-proposed

[Jamie Strandboge (jdstrand)]

Based on irc conversation, what is being pasted is an <img> tag, which is how the clipboard is supposed to work. Furthermore, the textfield is showing rich text by default (this should be configurable on a per widget basis), which is why the image is displayed. As such, this is not a security concern so I'll unsubscribe the security team.

[Renato Araujo Oliveira Filho (renatofilho)]

Fixed on the address-book-app components. But the Page title property used to display the contact name need to be fixed on the SDK.

[Víctor R. Ruiz (vrruiz)]

It also happens in the Name field.

[Jamie Strandboge (jdstrand)]

The security team discussed this a bit and we found this:
"Note that the Supported HTML Subset is limited. Also, if the text contains HTML img tags that load remote images, the text is reloaded." - http://qt-project.org/doc/qt-4.8/qml-text.html

This suggests an <img> tag could specify a remote image. While Victor's bug originated from a user-driven interaction, if/when we support vcards, we'll want to be very careful about importing vcard data that will download remote content when displayed. Changing to non-richtext will future-proof us from this down the line.

[Jamie Strandboge (jdstrand)]

Also, for completeness, here is the list of tags that richtext will honor: http://qt-project.org/doc/qt-4.8/richtext-html-subset.html

[Renato Araujo Oliveira Filho (renatofilho)]

I noticed that on desktop the clipboard does not copy the "img" tags.

[Zsombor Egri (zsombi)]

Please note that the text input has text formatting flags you can choose manually to not to interpret the entered text as rich text. The default setting is Automatic, meaning it'll try to detect the text type. OTOH, if the rich content is desired, you may need to filter the clipboard content before pasting into the input field.

[Christian Dywan (kalikiana)]

From discussion this just now, it seems to me there are good arguments both ways, some use cases require rich text, others don't. And this includes the header, for example the Wikipedia scope customizes the font. Arguably only a minority is putting untrusted html into text fields, and it's fair for the address book to override the header.

[Tim Peeters (tpeeters)]

For textfields and Labels in apps, the allowed input can be configured.

For internal labels that cannot be configured (like the title in the header, or text in a button) please report separate bugs. For those we need to carefully evaluate if we want to change the current behavior, and if we change it, see if it breaks any existing apps and update those.

[Víctor R. Ruiz (vrruiz)]

The rich-text name field propagates to other applications, like the indicator. See screenshot.

[Renato Araujo Oliveira Filho (renatofilho)]

i do not have control where this text will appear, probably you will find more places where this happen. (Contacts scope for example).

My suggestion is make all SDK labels plainText by default and the programmer can change it if necessary.