IJHack / QtPass / 34830797798

93%

push

github

Backport: password pane and URL tooltip HTML entity fixes (#1709) (#1712)

* Fix password pane showing &, " and > as HTML entities (#1682) (#1683)

PasswordDisplayPanel::addField() HTML-escapes every field value so URLs
can be wrapped in <a> tags, then hands the result to
QTextBrowser::setText(). setText() only treats its argument as rich text
when Qt::mightBeRichText() says so, and that heuristic essentially looks
for a '<'. A value with no URL and no '<' therefore stayed in plain-text
mode with the escaping still applied: a password such as `a&b` was shown
as `a&amp;b`, `"` as `&quot;` and `>` as `&gt;`. With the default
generated-password character set this affected a sizeable share of
entries and users copied the wrong secret by hand.

Decide the mode explicitly instead of relying on auto-detection: when the
value contains no URL it is shown verbatim with setPlainText(); when it
does, the escaped, anchor-wrapped string goes through setHtml(). The
linked-text builder now only runs in the URL case.

Extend the passworddisplaypanel suite with data-driven cases for &, ", >,
<, ', mixed specials and entity-looking input, an unhidden-password case,
and a URL case that checks the anchor still renders and the surrounding
prose is not double-escaped.

Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
(cherry picked from commit 9408db144)

* Fix open-in-browser tooltip showing &amp; in URLs (#1682) (#1693)

* Fix open-in-browser tooltip showing &amp; in URLs (#1682)

The password pane's "Open %1 in browser" button HTML-escapes the URL
before handing it to setToolTip(). QToolTip auto-detects the text
format and only takes the rich-text path when the string looks like
markup, so for a URL with a query string nothing decodes the escaping
and the hover text reads `Open https://example.org/?a=1&amp;b=2 in
browser`. Same root cause as #1683, in the same ... (continued)

16 of 16 new or added lines in 1 file covered. (100.0%)

4662 of 7233 relevant lines covered (64.45%)

62.98 hits per line