https://bugs.kde.org/show_bug.cgi?id=525879

--- Comment #1 from Lutz-Christian Quander <[email protected]> ---
The description can't be edited after filing, so the corrections go as a
comment:

Corrections and cross-references after filing.

EXISTING REPORTS I MISSED
Bug 501030 (CONFIRMED, 2025-03-03, MR !5292 unmerged) already established that
content is written to ~/.local/share/klipper/data/ with history options
disabled. My §2 and §3 corroborate it on Plasma 6.7.5 -- they are not new.
Bug 518176 (RESOLVED DOWNSTREAM, 2026-03-26) reported that history cannot be
disabled by any discoverable method.

NOT COVERED BY EITHER
- §1  blob count against the history limit, measured on two machines that have
      no klipperrc at all
- §5  store permissions allow OTHER LOCAL ACCOUNTS to read it on Ubuntu-family
      defaults; 501030 discusses same-user process access
- §6  blob filenames are unsalted SHA1 of the content

ON THE DOWNSTREAM CLOSURE OF 518176
§1, §2, §4 and §6 are Klipper's own retention logic and storage design. No
distribution can fix them. §5 is the only finding where packaging is a factor,
and ssh/gnupg force 0700/0600 regardless of umask precisely because inheriting
it is wrong for sensitive data.

ON THE WORKAROUND
Deleting the store is insufficient: plasmashell holds it open, so unlinking
removes the name and leaves the data readable via /proc/<pid>/fd. Measured on
Plasma 6.7.5: 106 KB database + 408 KB WAL still reachable after deletion,
until the shell restarted. VACUUM + PRAGMA wal_checkpoint(TRUNCATE) on the live
file is the better remedy. This matches the /proc observation already made in
501030.

3. Optionally — comment on 501030

This is where the leverage is, since it's CONFIRMED with a patch waiting:

Three additional observations on Plasma 6.7.5, corroborating this report with
measurements not yet covered here. Filed separately as bug 525879.

1. Retention exceeds the history limit. On a machine with no klipperrc at all
   (Fedora 44, Plasma 6.7.5), ~/.local/share/klipper/data held 39 blobs. The
   popup does not offer 39 entries; the surplus is unreachable through any UI.

2. Permissions permit other local accounts, not only same-user processes. On
   stock Kubuntu 24.04.5 (umask 0002, home 751), every path component grants
   o+x and history2.lst is 664. Arch and Fedora escape this only
   create homes at 700 -- Klipper's own directory is 755 with the store at 644
   on all three, so the containment is the home directory's doing
   Klipper's.

3. Blob filenames are unsalted SHA1 of the content:
       printf '%s' "CLIPTEST-MARKER-93741" | sha1sum
   matches the stored filename exactly. A leftover filename therefore permits
   confirming a guessed value, and brute-forcing low-entropy cont
   after the blob itself is removed.

-- 
You are receiving this mail because:
You are watching all bug changes.

Reply via email to