Skip to content

Merge rc to beta#14176

Merged
seanbudd merged 6 commits into
betafrom
mergeRcToBeta
Sep 26, 2022
Merged

Merge rc to beta#14176
seanbudd merged 6 commits into
betafrom
mergeRcToBeta

Conversation

@seanbudd

Copy link
Copy Markdown
Member

Merge rc to beta

Must be merge commit not squash merge

Addresses GHSA-585m-rpvv-93qg

Summary of the issue:
NVDA introduced the report dev info script as a safe script for the lock screen in 2021.3.2 via #13328.
This was under the assumption that the log viewer never shows up on the lock screen.

However, using certain steps, the log viewer can be interacted with on the lock screen.
Further steps allow opening the NVDA python console, allowing arbitrary code execution.

Description of user facing changes
The devInfo script (open the log viewer and report navigator object information) is no longer available on the lock screen.

Description of development approach
Remove devInfo from safe scripts

Review the security of other scripts in safe scripts.

Added additional security protection to ScreenExplorer used by touch interaction, as well as setting the review position with api.setReviewPosition.

Testing strategy:
Test with a self-signed build the STR in GHSA-585m-rpvv-93qg
@seanbudd seanbudd requested a review from a team as a code owner September 21, 2022 05:55
@seanbudd seanbudd requested review from feerrenrut and removed request for a team September 21, 2022 05:55
@AppVeyorBot

Copy link
Copy Markdown

@CyrilleB79

Copy link
Copy Markdown
Contributor

Please have a look at 428622f#r84574470 before merging.
Thanks.

@AppVeyorBot

Copy link
Copy Markdown

See test results for failed build of commit 8feb183185

@seanbudd seanbudd marked this pull request as draft September 26, 2022 00:23
@seanbudd

Copy link
Copy Markdown
Member Author

blocked by #14185 and #14184

@seanbudd seanbudd marked this pull request as ready for review September 26, 2022 02:20
@seanbudd seanbudd removed the blocked label Sep 26, 2022
@seanbudd seanbudd added this to the 2022.2.4 milestone Sep 26, 2022
@seanbudd seanbudd merged commit 81045c9 into beta Sep 26, 2022
@seanbudd seanbudd deleted the mergeRcToBeta branch September 26, 2022 03:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants