306091 - SVG security review: Cairo library text handling

Status: RESOLVED INVALID

(Core :: SVG, defect)

Description

[Jesse Ruderman]

T Rowley mentioned that this is part of the SVG attack surface and could do with
a security review:

  * cairo library text handling?

Comment 1

[Jesse Ruderman]

I don't know if tor meant this to be "Make sure SVG uses Cairo APIs safely and
correctly" or "Make sure Cairo doesn't have security holes in the way it handles
text".

I guess the things I'd worry about are:

1. Very long one-line strings (which tend to cause OS freezes/crashes,
overlapping text, or disappearing text with current GFX, see bug 302294).

2. Handling of international characters / confusion about the character-encoding
in strings, because I've heard of scary crashes involving that kind of thing before.

3. Handling of strings (e.g. from JavaScript) that contain embedded nulls.

4. Downloadable fonts, if that feature exists.

5. Spoofing in dialogs (multiple text strings that look the same or similar to
humans).

6. Correctness of any code that manipulates strings at a low level, whether for
parsing or displaying.

I wonder if that overlaps at all with what tor was thinking.

Pav mentioned that the way Cairo handles fonts has changed completely, and the
new version is about to be checked in on trunk.

Comment 2

[Jonathan Watt [:jwatt]]

Since we're now using cairo across the board, is this bug still relevant?

Comment 3

[Jesse Ruderman]

Probably not.  We have had some SVG-specific bugs involving cairo text, such as bug 396321, though.

Comment 4

[Jonathan Watt [:jwatt]]

I can't see that bug (as per usual). If you think it's not worth keeping this open (nothing will happen), can you close it?

Comment 5

[Jesse Ruderman]

I CCed you on it, so you can see it now.