From 48359cc8a62c916d62fae158b5c5d724111d5163 Mon Sep 17 00:00:00 2001
From: Tom Anderson <[email protected]>
Date: Wed, 03 Jun 2026 15:29:45 -0700
Subject: [PATCH] Validate and sanitize icon theme names in GTK and Qt backends.

An attacker with access to XSETTINGS (such as a compromised GPU process)
could publish a path-traversal payload (e.g., ../../../Downloads) for
the Net/IconThemeName property. Since GTK joins this property onto
standard search paths without relative-path checks, GDK/GTK would
resolve lookups to ~/Downloads and invoke unsandboxed host SVG/image
parsers (such as librsvg or gdk-pixbuf) on attacker-controlled files.

To prevent this:

1. GtkUi now validates and sanitizes `gtk-icon-theme-name`. When
   GtkUi detects an unsafe theme name (either on startup or via
   setting change notifications), it automatically resets GtkSettings'
   icon theme to the standard, safe "hicolor" default theme.
2. Optimized the GTK event-loop handling to return early from
   OnThemeChanged() when GtkUi::SanitizeIconThemeName() mutates the
   property, which avoids redundant clearing and rebuilding of UI colors
   from recursive notify signals.
3. Added defense-in-depth to GetIconForContentType() in both GTK and Qt
   backends to reject lookups and return a null image if the active
   theme name is unsafe.

Fixed: 519258799
Change-Id: I411d4516cfe365553ef4252d377d630273d5c66d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7896266
Reviewed-by: Lei Zhang <[email protected]>
Commit-Queue: Thomas Anderson <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1641259}
---

diff --git a/ui/gtk/gtk_ui.cc b/ui/gtk/gtk_ui.cc
index 43dd02ec..2aec6f0 100644
--- a/ui/gtk/gtk_ui.cc
+++ b/ui/gtk/gtk_ui.cc
@@ -22,6 +22,7 @@
 #include "base/containers/flat_map.h"
 #include "base/debug/leak_annotations.h"
 #include "base/environment.h"
+#include "base/files/file_path.h"
 #include "base/functional/bind.h"
 #include "base/logging.h"
 #include "base/nix/mime_util_xdg.h"
@@ -288,6 +289,24 @@
   return true;
 }
 
+bool IsValidIconThemeName(const std::string& theme) {
+  base::FilePath theme_path(theme);
+  return !theme.empty() && theme != "." && !theme_path.IsAbsolute() &&
+         !theme_path.ReferencesParent() && theme_path.BaseName() == theme_path;
+}
+
+std::string GetIconThemeName() {
+  gchar* theme = nullptr;
+  g_object_get(gtk_settings_get_default(), "gtk-icon-theme-name", &theme,
+               nullptr);
+  std::string theme_string;
+  if (theme) {
+    theme_string = theme;
+    g_free(theme);
+  }
+  return theme_string;
+}
+
 }  // namespace
 
 GtkUi::GtkUi() : window_frame_actions_() {}
@@ -345,6 +364,7 @@
   };
 
   GtkSettings* settings = gtk_settings_get_default();
+  SanitizeIconThemeName();
   connect(settings, "notify::gtk-theme-name", &GtkUi::OnThemeChanged);
   connect(settings, "notify::gtk-icon-theme-name", &GtkUi::OnThemeChanged);
   connect(settings, "notify::gtk-application-prefer-dark-theme",
@@ -495,6 +515,10 @@
 gfx::Image GtkUi::GetIconForContentType(const std::string& content_type,
                                         int dip_size,
                                         float scale) const {
+  if (!IsValidIconThemeName(GetIconThemeName())) {
+    return gfx::Image();
+  }
+
   // This call doesn't take a reference.
   GtkIconTheme* theme = GetDefaultIconTheme();
 
@@ -772,6 +796,16 @@
   return theme_string;
 }
 
+bool GtkUi::SanitizeIconThemeName() {
+  std::string theme = GetIconThemeName();
+  if (!IsValidIconThemeName(theme)) {
+    g_object_set(gtk_settings_get_default(), "gtk-icon-theme-name", "hicolor",
+                 nullptr);
+    return true;
+  }
+  return false;
+}
+
 int GtkUi::GetCursorThemeSize() {
   gint size = 0;
   g_object_get(gtk_settings_get_default(), "gtk-cursor-theme-size", &size,
@@ -822,6 +856,9 @@
 #endif
 
 void GtkUi::OnThemeChanged(GtkSettings* settings, GtkParamSpec* param) {
+  if (SanitizeIconThemeName()) {
+    return;  // Exit early; modifying the setting re-triggered this function
+  }
   colors_.clear();
   custom_frame_colors_.clear();
   native_frame_colors_.clear();
diff --git a/ui/gtk/gtk_ui.h b/ui/gtk/gtk_ui.h
index ecc60166..a5d3bd2c 100644
--- a/ui/gtk/gtk_ui.h
+++ b/ui/gtk/gtk_ui.h
@@ -117,6 +117,10 @@
 
   void OnThemeChanged(GtkSettings* settings, GtkParamSpec* param);
 
+  // Sanitizes the "gtk-icon-theme-name" setting in GtkSettings if it is unsafe.
+  // Returns true if the setting was modified.
+  bool SanitizeIconThemeName();
+
   void OnCursorThemeNameChanged(GtkSettings* settings, GtkParamSpec* param);
 
   void OnCursorThemeSizeChanged(GtkSettings* settings, GtkParamSpec* param);
diff --git a/ui/qt/qt_shim.cc b/ui/qt/qt_shim.cc
index 6a537293..4a9ac537 100644
--- a/ui/qt/qt_shim.cc
+++ b/ui/qt/qt_shim.cc
@@ -216,6 +216,16 @@
   return scale > 0 ? scale : 1.0;
 }
 
+bool IsValidIconThemeName(const QString& theme) {
+  if (theme.isEmpty() || theme == "." || theme == "..") {
+    return false;
+  }
+  if (theme.contains('/') || theme.contains('\\') || theme.contains("..")) {
+    return false;
+  }
+  return true;
+}
+
 }  // namespace
 
 QtShim::QtShim(QtInterface::Delegate* delegate, int* argc, char** argv)
@@ -275,6 +285,10 @@
 
 Image QtShim::GetIconForContentType(const String& content_type,
                                     int size) const {
+  if (!IsValidIconThemeName(QIcon::themeName())) {
+    QIcon::setThemeName("hicolor");
+  }
+
   QMimeDatabase db;
   for (const char* mime : {content_type.c_str(), "application/octet-stream"}) {
     auto mt = db.mimeTypeForName(mime);