From 1caa8920ae197046de619c8974ffe833a4d2b420 Mon Sep 17 00:00:00 2001 From: Dieter Mayer Date: Fri, 24 Jul 2026 15:33:49 +0200 Subject: [PATCH] Harden QDom serialization against invalid data (CVE-2026-15037) Set QDomImplementation::setInvalidDataPolicy(ReturnNullNode) at startup. Qt before 6.12 defaults to accepting invalid data when building QDom nodes, so untrusted text inserted into comments, CDATA sections or processing instructions could break out of its node on serialization (XML injection, low severity). Qt 6.12 flips the default to ReturnNullNode; opting in explicitly gives the same behavior on any Qt 5/6 version, so no version guard is needed. Verified: --resave of a 5-folio project produces valid XML with all folios intact, and --export-pdf still works on the result. (cherry picked from commit 7804ef3864a0b8643cfe13b68b8e0e6235508ab6) --- sources/main.cpp | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sources/main.cpp b/sources/main.cpp index db3accc86..10c4bc90b 100644 --- a/sources/main.cpp +++ b/sources/main.cpp @@ -24,6 +24,7 @@ #include "utils/qetsettings.h" #include +#include #include #include @@ -207,6 +208,12 @@ int main(int argc, char **argv) QCoreApplication::setOrganizationName("QElectroTech"); QCoreApplication::setOrganizationDomain("qelectrotech.org"); QCoreApplication::setApplicationName("QElectroTech"); + + // Refuse invalid data when building QDom documents instead of + // serializing malformed XML (CVE-2026-15037). This is the default + // from Qt 6.12 on; opt in explicitly for older Qt 5/6. + QDomImplementation::setInvalidDataPolicy( + QDomImplementation::ReturnNullNode); //Creation and execution of the application //HighDPI #if QT_VERSION < QT_VERSION_CHECK(5, 14, 0) // ### Qt 6: remove