Ryan Gonzalez 5daba75daf
Fix metadata file contents after null terminators being ignored ...
In particular, if a null terminator is placed inside the metadata file,
Flatpak will only compare the text *before* it to the value of
xa.metadata, but the full file will be parsed when permissions are set
at runtime. This means that any app can include a null terminator in its
permissions metadata, and Flatpak will only show the user the
permissions *preceding* the terminator during install, but the
permissions *after* the terminator are applied at runtime.
Fixes GHSA-qpjc-vq3c-572j / CVE-2021-43860
Signed-off-by: Ryan Gonzalez <ryan.gonzalez@collabora.com >
(cherry picked from commit c9c3a667c09a846c0b230cf1cc8ed330028aa03c)
2022-01-12 11:52:15 +01:00
2019-10-03 10:42:04 +02:00
2019-12-19 16:52:58 +01:00
2019-12-19 10:33:21 +01:00
2020-05-04 16:32:22 +02:00
2020-11-10 14:32:13 +01:00
2021-02-12 15:58:09 +01:00
2021-04-16 09:13:18 +02:00
2021-04-16 09:13:18 +02:00
2019-09-19 16:53:11 +00:00
2019-09-19 16:53:11 +00:00
2021-01-12 09:55:23 +01:00
2021-05-25 11:11:03 +02:00
2021-05-25 11:11:03 +02:00
2022-01-11 11:51:02 +01:00
2022-01-12 11:52:15 +01:00
2021-01-11 11:05:57 +01:00
2018-05-24 11:59:52 +00:00
2019-02-25 18:12:30 +00:00
2021-02-09 09:36:59 +01:00
2021-08-02 08:37:25 +02:00
2021-09-23 09:57:33 +02:00
2019-10-02 14:57:11 +02:00
2022-01-11 11:51:02 +01:00
2021-06-14 15:30:59 +01:00
2020-11-05 10:43:10 +01:00
2020-12-14 11:25:16 +01:00
2021-02-12 15:58:09 +01:00
2021-04-16 09:13:18 +02:00
2021-04-16 09:13:18 +02:00
2021-02-12 15:58:09 +01:00
2020-06-05 09:35:30 +02:00
2020-06-11 15:57:39 +02:00
2018-08-09 12:49:36 +00:00
2020-03-16 09:29:31 +01:00
2020-06-05 09:35:30 +02:00
2021-04-16 14:49:15 +02:00
2019-10-03 10:42:04 +02:00
2019-11-08 00:30:44 +09:00
2018-04-26 07:41:17 +00:00
2019-12-01 14:04:59 -05:00
2020-03-27 17:23:13 +01:00
2021-05-04 10:23:13 +02:00
2021-04-26 10:30:14 +02:00
2021-04-26 10:30:14 +02:00
2020-11-16 11:23:10 +01:00
2021-04-19 09:09:04 +02:00
2021-02-09 09:34:47 +01:00
2021-02-12 15:58:09 +01:00
2020-03-23 17:58:04 +01:00
2022-01-04 11:43:51 +00:00
2021-02-12 15:58:09 +01:00
2020-03-25 08:52:28 +01:00
2020-11-05 10:43:10 +01:00
2020-11-05 10:43:10 +01:00
2021-02-12 15:58:09 +01:00
2020-07-21 08:59:22 +02:00
2021-02-12 15:58:09 +01:00
2021-04-15 18:00:47 +02:00
2022-01-04 10:44:37 -08:00
2021-10-08 12:53:20 +02:00
2021-05-19 09:49:30 +02:00
2022-01-12 11:52:15 +01:00
2021-02-12 15:58:09 +01:00
2020-12-09 08:34:19 +01:00
2021-08-02 08:37:25 +02:00
2020-08-10 15:20:59 +02:00
2022-01-11 11:51:02 +01:00
2021-09-17 09:23:52 +02:00
2022-01-12 11:52:15 +01:00
2019-12-02 07:45:51 -05:00
2020-06-05 09:35:30 +02:00
2020-06-05 09:35:30 +02:00
2018-05-24 11:59:52 +00:00
2018-10-08 08:36:23 +00:00
2021-10-08 12:53:20 +02:00
2020-09-15 08:58:49 +02:00
2019-04-08 12:50:42 +00:00
5daba75daf