gnome-shell/SOURCES/defend-against-corrupt-notifications.patch

From 7bdd1962213a37f6218fe15ea1a4062dd318672a Mon Sep 17 00:00:00 2001
From: Will Thompson <wjt@endlessm.com>
Date: Wed, 28 Aug 2019 15:39:44 +0100
Subject: [PATCH 1/2] global: Don't trust persistent/runtime state data

An Endless OS system was found in the wild with a malformed
.local/share/gnome-shell/notifications. When deserialized in Python,
after passing trusted=True to g_variant_new_from_bytes(), the first
element of the first struct in the array looks like this:

    In [41]: _38.get_child_value(0).get_child_value(0)
    Out[41]: GLib.Variant('s', '\Uffffffff\Uffffffff\Uffffffff\Uffffffff\Uffffffff')

When deserialised in GJS, we get:

    gjs> v.get_child_value(0).get_child_value(0)
    [object variant of type "s"]
    gjs> v.get_child_value(0).get_child_value(0).get_string()
    typein:43:1 malformed UTF-8 character sequence at offset 0
      @typein:43:1
      @<stdin>:1:34

While g_variant_new_from_bytes() doesn't have much to say about its
'trusted' parameter, g_variant_new_from_data() does:

> If data is trusted to be serialised data in normal form then trusted
> should be TRUE. This applies to serialised data created within this
> process or read from a trusted location on the disk (such as a file
> installed in /usr/lib alongside your application). You should set
> trusted to FALSE if data is read from the network, a file in the
> user's home directory, etc.

Persistent state is read from the user's home directory, so it should
not be trusted. With trusted=False, the string value above comes out as
"".

I don't have an explanation for how this file ended up being malformed.
I also don't have an explanation for when this started crashing: my
guess is that recent GJS became stricter about validating UTF-8 but I
could be wrong!

https://gitlab.gnome.org/GNOME/gnome-shell/issues/1552
---
 src/shell-global.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/shell-global.c b/src/shell-global.c
index 4b33778e0..33046f614 100644
--- a/src/shell-global.c
+++ b/src/shell-global.c
@@ -1707,7 +1707,7 @@ load_variant (GFile      *dir,
   else
     {
       GBytes *bytes = g_mapped_file_get_bytes (mfile);
-      res = g_variant_new_from_bytes (G_VARIANT_TYPE (property_type), bytes, TRUE);
+      res = g_variant_new_from_bytes (G_VARIANT_TYPE (property_type), bytes, FALSE);
       g_bytes_unref (bytes);
       g_mapped_file_unref (mfile);
     }
-- 
2.35.1


From 13dcb3e4400b92a0d2f548e88b70b358240d462c Mon Sep 17 00:00:00 2001
From: Will Thompson <wjt@endlessm.com>
Date: Wed, 28 Aug 2019 15:38:03 +0100
Subject: [PATCH 2/2] notificationDaemon: Catch exceptions while loading
 notifications

An Endless OS system was found in the wild with a malformed
.local/share/gnome-shell/notifications which causes _loadNotifications()
to raise an exception. This exception was not previously handled and
bubbles all the way out to gnome_shell_plugin_start(), whereupon the
shell exit(1)s. The user could no longer log into their computer.

Handle exceptions from _loadNotifications(), log them, and attempt to
continue. Ensure that this._isLoading is set to 'false' even on error,
so that future calls to _saveNotifications() can overwrite the (corrupt)
state file.

https://gitlab.gnome.org/GNOME/gnome-shell/issues/1552
---
 js/ui/notificationDaemon.js | 42 ++++++++++++++++++++-----------------
 1 file changed, 23 insertions(+), 19 deletions(-)

diff --git a/js/ui/notificationDaemon.js b/js/ui/notificationDaemon.js
index 4bdede841..dbe673b88 100644
--- a/js/ui/notificationDaemon.js
+++ b/js/ui/notificationDaemon.js
@@ -749,29 +749,33 @@ var GtkNotificationDaemon = class GtkNotificationDaemon {
     _loadNotifications() {
         this._isLoading = true;
 
-        let value = global.get_persistent_state('a(sa(sv))', 'notifications');
-        if (value) {
-            let sources = value.deep_unpack();
-            sources.forEach(([appId, notifications]) => {
-                if (notifications.length == 0)
-                    return;
-
-                let source;
-                try {
-                    source = this._ensureAppSource(appId);
-                } catch(e) {
-                    if (e instanceof InvalidAppError)
+        try {
+            let value = global.get_persistent_state('a(sa(sv))', 'notifications');
+            if (value) {
+                let sources = value.deep_unpack();
+                sources.forEach(([appId, notifications]) => {
+                    if (notifications.length == 0)
                         return;
-                    throw e;
-                }
 
-                notifications.forEach(([notificationId, notification]) => {
-                    source.addNotification(notificationId, notification.deep_unpack(), false);
+                    let source;
+                    try {
+                        source = this._ensureAppSource(appId);
+                    } catch (e) {
+                        if (e instanceof InvalidAppError)
+                            return;
+                        throw e;
+                    }
+
+                    notifications.forEach(([notificationId, notification]) => {
+                        source.addNotification(notificationId, notification.deep_unpack(), false);
+                    });
                 });
-            });
+            }
+        } catch (e) {
+            logError(e, 'Failed to load saved notifications');
+        } finally {
+            this._isLoading = false;
         }
-
-        this._isLoading = false;
     }
 
     _saveNotifications() {
-- 
2.35.1