feat(Security): Add process sandbox for image parsing.

CMakeLists.txt

@@ -287,6 +287,8 @@ set(${BINARY_NAME}_SOURCES
     src/chatlog/customtextdocument.h
     src/chatlog/documentcache.cpp
     src/chatlog/documentcache.h
+    src/chatlog/imageloader.cpp
+    src/chatlog/imageloader.h
     src/chatlog/pixmapcache.cpp
     src/chatlog/pixmapcache.h
     src/core/toxfileprogress.cpp
@@ -457,6 +459,12 @@ set(${BINARY_NAME}_SOURCES
     src/platform/desktop_notifications/desktopnotifybackend.h
     src/platform/posixsignalnotifier.cpp
     src/platform/posixsignalnotifier.h
+    src/platform/sandbox.cpp
+    src/platform/sandbox.h
+    src/platform/sandboxclient.cpp
+    src/platform/sandboxclient.h
+    src/platform/sandboxserver.cpp
+    src/platform/sandboxserver.h
     src/platform/screenshot_dbus.cpp
     src/platform/screenshot.cpp
     src/platform/screenshot.h
@@ -689,6 +697,8 @@ add_subdirectory(cmake/warnings)
 
 add_library(${BINARY_NAME}_static STATIC ${${BINARY_NAME}_FORMS}
                                          ${${BINARY_NAME}_SOURCES})
+qt_add_repc_sources(${BINARY_NAME}_static src/platform/sandbox.rep)
+qt_add_repc_replicas(${BINARY_NAME}_static src/platform/sandbox.rep)
 target_link_libraries(${BINARY_NAME}_static ${CMAKE_REQUIRED_LIBRARIES}
                       ${ALL_LIBRARIES} coverage_config)
 

cmake/Dependencies.cmake

@@ -16,6 +16,7 @@ find_package(Qt6 REQUIRED COMPONENTS
   Gui
   Linguist
   Network
+  RemoteObjects
   Svg
   Test
   Widgets
@@ -32,6 +33,7 @@ add_dependency(
   Qt6::Core
   Qt6::Gui
   Qt6::Network
+  Qt6::RemoteObjects
   Qt6::Svg
   Qt6::Widgets
   Qt6::Xml)

src/BUILD.bazel

@@ -1,5 +1,5 @@
 load("@rules_cc//cc:defs.bzl", "cc_library", "objc_library")
-load("//third_party/qt:build_defs.bzl", "qt_moc", "qt_uic")
+load("//third_party/qt:build_defs.bzl", "qt_moc", "qt_repc", "qt_uic")
 load("//tools/project:build_defs.bzl", "mkstamp")
 
 DEFINES = [
@@ -10,6 +10,20 @@ DEFINES = [
     "UPDATE_CHECK_ENABLED",
 ]
 
+qt_repc(
+    name = "src_repc_source",
+    srcs = ["platform/sandbox.rep"],
+    tags = ["qt"],
+    type = "source",
+)
+
+qt_repc(
+    name = "src_repc_replica",
+    srcs = ["platform/sandbox.rep"],
+    tags = ["qt"],
+    type = "replica",
+)
+
 qt_moc(
     name = "src_moc",
     srcs = [
@@ -24,6 +38,7 @@ qt_moc(
         "chatlog/content/text.h",
         "chatlog/content/timestamp.h",
         "chatlog/customtextdocument.h",
+        "chatlog/imageloader.h",
         "core/core.h",
         "core/coreav.h",
         "core/corefile.h",
@@ -60,6 +75,9 @@ qt_moc(
         "platform/desktop_notifications/desktopnotify.h",
         "platform/desktop_notifications/desktopnotifybackend.h",
         "platform/posixsignalnotifier.h",
+        "platform/sandbox.h",
+        "platform/sandboxclient.h",
+        "platform/sandboxserver.h",
         "platform/screenshot_dbus.h",
         "video/camerasource.h",
         "video/corevideosource.h",
@@ -127,15 +145,19 @@ qt_moc(
         "widget/tool/screenshotgrabber.h",
         "widget/tool/toolboxgraphicsitem.h",
         "widget/widget.h",
+        ":src_repc_replica",
+        ":src_repc_source",
     ],
     hdrs = glob(["**/*.h"]),
     mocopts = [
         "-Iqtox",
+        "-Iqtox/src",
         "-Iqtox/util/include",
     ] + ["-D%s=1" % d for d in DEFINES],
     tags = ["qt"],
     deps = [
         "//qtox/util",
+        "@qt//:qt_remoteobjects",
         "@qt//:qt_widgets",
     ],
 )
@@ -219,6 +241,8 @@ cc_library(
     name = "src",
     srcs = [":version"] + [
         ":src_moc",
+        ":src_repc_replica",
+        ":src_repc_source",
         ":src_ui",
     ] + glob(
         ["**/*.cpp"],
@@ -235,7 +259,7 @@ cc_library(
             "persistence/serialize.h",
         ],
     ),
-    copts = COPTS,
+    copts = COPTS + ["-I$(GENDIR)/qtox/src/platform"],
     defines = DEFINES,
     includes = ["."],
     linkopts = select({
@@ -264,6 +288,7 @@ cc_library(
         "@qt//:qt_dbus",
         "@qt//:qt_gui",
         "@qt//:qt_network",
+        "@qt//:qt_remoteobjects",
         "@qt//:qt_svg",
         "@qt//:qt_widgets",
         "@qt//:qt_xml",
@@ -282,15 +307,7 @@ cc_library(
 cc_library(
     name = "main",
     srcs = ["main.cpp"],
-    copts = [
-        "-Iqtox",
-        "-I$(GENDIR)/qtox",
-    ] + select({
-        "//tools/config:freebsd": [],
-        "//tools/config:linux": ["-fPIC"],
-        "//tools/config:osx": [],
-        "//tools/config:windows": [],
-    }),
+    copts = COPTS,
     tags = ["qt"],
     visibility = ["//qtox:__subpackages__"],
     deps = [

src/appmanager.cpp

@@ -13,6 +13,8 @@
 #include "src/persistence/settings.h"
 #include "src/persistence/toxsave.h"
 #include "src/platform/posixsignalnotifier.h"
+#include "src/platform/sandboxclient.h"
+#include "src/platform/sandboxserver.h"
 #include "src/version.h"
 #include "src/video/camerasource.h"
 #include "src/widget/tool/messageboxmanager.h"
@@ -25,6 +27,7 @@
 #include <QFontDatabase>
 #include <QMessageBox>
 #include <QObject>
+#include <QRemoteObjectHost>
 
 #include <memory>
 
@@ -220,7 +223,6 @@ AppManager::AppManager(int& argc, char** argv)
     : qapp((preConstructionInitialization(), new QApplication(argc, argv)))
     , messageBoxManager(new MessageBoxManager(nullptr))
     , settings(new Settings(*messageBoxManager))
-    , ipc(new IPC(settings->getCurrentProfileId()))
 {
 }
 
@@ -231,6 +233,37 @@ void AppManager::preConstructionInitialization()
 
 int AppManager::startGui(QCommandLineParser& parser)
 {
+    // Terminating signals are connected directly to quit() without any filtering.
+    connect(&PosixSignalNotifier::globalInstance(), &PosixSignalNotifier::terminatingSignal,
+            qapp.get(), &QApplication::quit);
+    PosixSignalNotifier::watchCommonTerminatingSignals();
+
+    // User signal 1 is used to screenshot the application.
+    connect(&PosixSignalNotifier::globalInstance(), &PosixSignalNotifier::usrSignal, qapp.get(),
+            [this](PosixSignalNotifier::UserSignal signal) {
+                if (signal == PosixSignalNotifier::UserSignal::Screenshot) {
+                    nexus->screenshot();
+                }
+            });
+    PosixSignalNotifier::watchUsrSignals();
+
+    // Install Unicode 6.1 supporting font
+    // Keep this as close to the beginning of `main()` as possible, otherwise
+    // on systems that have poor support for Unicode qTox will look bad.
+    if (QFontDatabase::addApplicationFont(":/font/DejaVuSans.ttf") == -1) {
+        qWarning() << "Couldn't load font";
+    }
+
+    if (parser.isSet("portable")) {
+        // We don't go through settings here, because we're not making qTox
+        // portable (which moves files around). Instead, we start up in
+        // portable mode as a one-off.
+        settings->getPaths().setPortable(true);
+        settings->getPaths().setPortablePath(parser.value("portable"));
+    }
+
+    ipc = std::make_unique<IPC>(settings->getCurrentProfileId());
+
     if (ipc->isAttached()) {
         connect(settings.get(), &Settings::currentProfileIdChanged, ipc.get(), &IPC::setProfileId);
     } else {
@@ -288,6 +321,14 @@ int AppManager::startGui(QCommandLineParser& parser)
     qDebug() << "Commit:" << VersionInfo::gitVersion();
     qDebug() << "Process ID:" << QCoreApplication::applicationPid();
 
+    if (settings->getExperimentalSandbox()) {
+        sandbox = std::make_unique<SandboxClient>(this);
+        qDebug() << "Sandbox ready:" << sandbox->isReady();
+    } else {
+        sandbox = std::make_unique<SandboxServer>(this);
+        qDebug() << "Sandbox disabled";
+    }
+
     QString profileName;
     bool autoLogin = settings->getAutoLogin();
 
@@ -353,7 +394,7 @@ int AppManager::startGui(QCommandLineParser& parser)
     //  note: Because Settings is shouldering global settings as well as model specific ones it
     //  cannot be integrated into a central model object yet
     cameraSource = std::make_unique<CameraSource>(*settings);
-    nexus = std::make_unique<Nexus>(*settings, *messageBoxManager, *cameraSource, *ipc);
+    nexus = std::make_unique<Nexus>(*settings, *messageBoxManager, *cameraSource, *ipc, *sandbox);
     // Autologin
     // TODO (kriby): Shift responsibility of linking views to model objects from nexus
     // Further: generate view instances separately (loginScreen, mainGUI, audio)
@@ -401,35 +442,14 @@ int AppManager::startGui(QCommandLineParser& parser)
 
 int AppManager::run()
 {
-    // Terminating signals are connected directly to quit() without any filtering.
-    connect(&PosixSignalNotifier::globalInstance(), &PosixSignalNotifier::terminatingSignal,
-            qapp.get(), &QApplication::quit);
-    PosixSignalNotifier::watchCommonTerminatingSignals();
-
-    // User signal 1 is used to screenshot the application.
-    connect(&PosixSignalNotifier::globalInstance(), &PosixSignalNotifier::usrSignal, qapp.get(),
-            [this](PosixSignalNotifier::UserSignal signal) {
-                if (signal == PosixSignalNotifier::UserSignal::Screenshot) {
-                    nexus->screenshot();
-                }
-            });
-    PosixSignalNotifier::watchUsrSignals();
-
-    QApplication::setApplicationName("qTox");
-    QApplication::setDesktopFileName("io.github.qtox.qTox");
-    QApplication::setApplicationVersion(QStringLiteral("%1, git commit %2 (%3)")
-                                            .arg(VersionInfo::gitDescribe())
-                                            .arg(VersionInfo::gitVersion())
-                                            .arg(UpdateCheck::isCurrentVersionStable()
-                                                     ? QStringLiteral("stable")
-                                                     : QStringLiteral("unstable")));
-
-    // Install Unicode 6.1 supporting font
-    // Keep this as close to the beginning of `main()` as possible, otherwise
-    // on systems that have poor support for Unicode qTox will look bad.
-    if (QFontDatabase::addApplicationFont("://font/DejaVuSans.ttf") == -1) {
-        qWarning() << "Couldn't load font";
-    }
+    qapp->setApplicationName("qTox");
+    qapp->setDesktopFileName("io.github.qtox.qTox");
+    qapp->setApplicationVersion(QStringLiteral("%1, git commit %2 (%3)")
+                                    .arg(VersionInfo::gitDescribe())
+                                    .arg(VersionInfo::gitVersion())
+                                    .arg(UpdateCheck::isCurrentVersionStable()
+                                             ? QStringLiteral("stable")
+                                             : QStringLiteral("unstable")));
 
     const QString locale = settings->getTranslation();
     // We need to init the resources in the translations_library explicitly.
@@ -468,6 +488,7 @@ int AppManager::run()
 #ifdef UPDATE_CHECK_ENABLED
         {{"u", "update-check"}, tr("Checks whether this program is running the latest qTox version.")},
 #endif // UPDATE_CHECK_ENABLED
+        {{"S", "sandbox"}, tr("Start the qTox sandbox process (internal, don't use).")},
     });
 #ifdef Q_OS_WASM
     // Set to portable mode and TCP-only for WASM.
@@ -476,14 +497,6 @@ int AppManager::run()
     parser.process(*qapp);
 #endif
 
-    if (parser.isSet("portable")) {
-        // We don't go through settings here, because we're not making qTox
-        // portable (which moves files around). Instead, we start up in
-        // portable mode from the beginning without having to move any files.
-        settings->getPaths().setPortable(true);
-        settings->getPaths().setPortablePath(parser.value("portable"));
-    }
-
     // If update-check is requested, do it and exit.
     if (parser.isSet("update-check")) {
         auto* updateCheck = new UpdateCheck(*settings, qapp.get());
@@ -498,11 +511,20 @@ int AppManager::run()
                     QTextStream(stdout) << message;
                     QApplication::quit();
                 });
-    } else {
-        const int result = startGui(parser);
-        if (result != 0) {
-            return result;
-        }
+        return qapp->exec();
+    }
+
+    if (parser.isSet("sandbox")) {
+        // Start the sandbox process.
+        SandboxServer sandboxServer;
+        QRemoteObjectHost srcNode(QUrl(QStringLiteral("local:replica")));
+        srcNode.enableRemoting(&sandboxServer);
+        return qapp->exec();
+    }
+
+    const int result = startGui(parser);
+    if (result != 0) {
+        return result;
     }
 
     return QApplication::exec();

src/appmanager.h

@@ -9,14 +9,15 @@
 
 #include <memory>
 
-class MessageBoxManager;
-class Settings;
+class CameraSource;
 class IPC;
+class MessageBoxManager;
+class Nexus;
 class QApplication;
 class QCommandLineParser;
+class Sandbox;
+class Settings;
 class ToxURIDialog;
-class Nexus;
-class CameraSource;
 
 class AppManager : public QObject
 {
@@ -42,4 +43,5 @@ private slots:
     std::unique_ptr<ToxURIDialog> uriDialog;
     std::unique_ptr<CameraSource> cameraSource;
     std::unique_ptr<Nexus> nexus;
+    std::unique_ptr<Sandbox> sandbox;
 };

src/chatlog/chatmessage.cpp

@@ -5,7 +5,7 @@
 
 #include "chatmessage.h"
 
-#include "chatlinecontentproxy.h"
+#include "src/chatlog/chatlinecontentproxy.h"
 #include "textformatter.h"
 
 #include "content/broken.h"
@@ -15,6 +15,7 @@
 #include "content/spinner.h"
 #include "content/text.h"
 #include "content/timestamp.h"
+
 #include "src/persistence/history.h"
 #include "src/persistence/settings.h"
 #include "src/persistence/smileypack.h"
@@ -174,7 +175,7 @@ ChatMessage::Ptr ChatMessage::createFileTransferMessage(const QString& sender, C
                                                         ToxFile file, bool isMe, const QDateTime& date,
                                                         DocumentCache& documentCache,
                                                         Settings& settings, Style& style,
-                                                        IMessageBoxManager& messageBoxManager)
+                                                        IMessageBoxManager& messageBoxManager, ImageLoader& imageLoader)
 {
     ChatMessage::Ptr msg = std::make_shared<ChatMessage>(documentCache, settings, style);
 
@@ -187,7 +188,7 @@ ChatMessage::Ptr ChatMessage::createFileTransferMessage(const QString& sender, C
     msg->addColumn(new Text(documentCache, settings, style, sender, authorFont, true),
                    ColumnFormat(NAME_COL_WIDTH, ColumnFormat::FixedSize, ColumnFormat::Right));
     msg->addColumn(new ChatLineContentProxy(new FileTransferWidget(nullptr, coreFile, file, settings,
-                                                                   style, messageBoxManager),
+                                                                   style, messageBoxManager, imageLoader),
                                             320, 0.6f),
                    ColumnFormat(1.0, ColumnFormat::VariableSize));
     msg->addColumn(new Timestamp(date, settings.getTimestampFormat(), baseFont, documentCache,