After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 770856 - gedit gone berserk after several crashes, attempted overwriting random file HUGE SECURITY ISSUE
gedit gone berserk after several crashes, attempted overwriting random file H...
Status: RESOLVED OBSOLETE
Product: gedit
Classification: Applications
Component: general
3.10.x
Other Linux
: Normal critical
: ---
Assigned To: Gedit maintainers
Gedit maintainers
Depends on:
Blocks:
 
 
Reported: 2016-09-04 18:49 UTC by banned
Modified: 2020-11-24 09:57 UTC
See Also:
GNOME target: ---
GNOME version: ---



Description banned 2016-09-04 18:49:31 UTC
Note this is a HUGE SECURITY ISSUE potentially causing DATA LOSS.

I had used gedit to edit several files, then I closed it, and when I attempted to open it again (from the Launcher icon) it start to systematically crash every time I tried.

After a while, Ubuntu's crash report window appeared offering me to report the crash and relaunch Gedit, and for some reason after this it did start.


However, and here comes the huge security issue:
- I wrote some text
- I went to save the file by hitting Ctrl+S

Expected result: should prompt me for where to save the file
Actual result: it didn't prompt me for a location and filename, and it gave me an error message 
"Could not find the file ...."
with the path to a file which actually does exist, unrelated to what I'm editing (I am editing a new file from scratch, and I haven't saved it previously), and it is the path of a random file that I had been editing before closing Gedit before the crashes.
Now the filename displayed on the top of the tab (which is supposed to be the name of the file I am editing, which should be "Untitled") is the name of that file, and I'm not sure if it had been so since the beginning.

So now I've done a Save As, chosen a new path and file name, and saved, and it still gives me the same error message and it hasn't saved the file. Unless it has saved it at a random location.

Overall it is a complete nonsense:
- it didn't prompt me for the path where to save the file.
- the message "could not find file..." when attempting to save doesn't make sense. Is it failing to read or write? 
- Either way it's complaining for a random file that it shouldn't be trying to either read or write at all
- If it is attempting to write (which would be a huge bug, saving to some random file that I have not chosen), complaining about the inability to *find* it doesn't make sense: you either complain that it's parent directory doesn't exist (which is not the case) or that the file cannot be written for whatever reason
- if it is attempting to read it, there's no reason to
- it's complain that the file doesn't exist while indeed it does (which is a fortunate nonsense, because I wonder what it would have done with that random file, overwrite it?)
- it didn't save the file I created, at least not where I told it to save it (the second time with Save As).


It seems pretty clear that, after the crashes, Gedit has started in some corrupted state where critical information is completely messed up (such as the path of the current file being edited). The very fact that the sanity of this information is not checked is can potentially cause disastrous data loss/corruption.
Comment 1 Sébastien Wilmet 2020-11-24 09:57:21 UTC
Mass-closing of all gedit bugzilla tickets.

Special "code" to find again all those gedit bugzilla tickets that were open before the mass-closing:

2bfe1b0590a78457e1f1a6a90fb975f5878cb60064ccfe1d7db76ca0da52f0f3

By searching the above sha256sum in bugzilla, the gedit contributors can find again the tickets. We may be interested to do so when we work on a specific area of the code, to at least know the known problems and possible enhancements.

We do this mass-closing because bugzilla.gnome.org is being replaced by gitlab.gnome.org.