IJHack / QtPass / 38203813656

93%

Build Type

push

github

Committed by web-flow

Commit Message

GpgIdGeneration: a folder line with a control character is malformed (#2015)

fuzz_gpgid found a header that does not survive being written back (#2014's run): '# QtPass-GpgId-Folder: 7w]' ending in \r\r\n parsed to the folder '7w]\r' (parse() strips one \r), header() wrote it out and re-parsing gave '7w]'. Low impact, such a list is only refused as written for another folder, but a folder name with a control character is no name QtPass writes. The folder line is now refused when it holds any byte below 0x20 or DEL, with tests for \r\r\n, a tab, DEL and NUL, and the crash input as a fuzz seed.


Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d

Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Coverage Stats

3 of 3 new or added lines in 1 file covered. (100.0%)

1 existing line in 1 file now uncovered.

9082 of 9778 relevant lines covered (92.88%)

191.62 hits per line