Bug#1110370: stardict-plugin: YouDao plugin sends the user's selection from other apps to Chinese servers

[肖盛文]

Control: Severity -1 important

Hi,

在 2025/8/16 13:59, Max Nikulin 写道:
> On Mon, 4 Aug 2025 10:27:01 +0800 xiao sheng wen wrote:
>> Control: tags -1 - security
>> Control: Severity -1 wishlist
> 
> Xiao Sheng Wen, shouldn't severity be higher for this bug?
Yes!

> 
> I think, you set "wishlist" because network dictionaries and scanning X11 
> selection are important features for users who need to quickly translate 
> words and do it frequently. I agree in general, but privacy should be 
> respected as well. The security team has restored the "security" tag already.
> 
> I would consider to set severity at least to "important". Higher value causes 
> package removal from testing, and I do not find it reasonable.
> 
> In [1] Vincent wrote that apt-listbugs warns users about issues with severity 
> "serious" and above. In my opinion, users should be notified about this bug 
> before installing the packages. Accordingly to [2] it is possible to set 
> "forky-ignore" and maybe "bookworm-ignore" tags to prevent removal of the 
> packages from Debian repositories.
Most of the end normal user don't install apt-listbugs default.
> 
> If the release team approve adding "ignore" tags, will you agree to raise 
> severity to "serious"?

I had uploaded the new version to fix this bug, now is waiting for ftp-master 
team to process NEW,

https://ftp-master.debian.org/new/stardict_3.0.7+git20220909+dfsg-8.html

so set adding "ignore" tags in not necessary at present.
> 
> Original severity "critical" likely is not appropriate since the security 
> team added: " (Minor issue)" [3].
> 
> I really hope that with cooperation from the upstream developers, it is 
> possible to keep all features convenient for users, but to avoid issues 
> related to privacy in default configuration.
Stardict is a long history software, although the upstream developers is not 
very active,
but he still can do some minor update. 

> 
> [1] Vincent Lefevre to debian-user.
>     Re: Security: Be careful with StarDict!
>     Fri, 8 Aug 2025 15:29:17 +0200.
>  
> 
> 
> [2] Tags for bug reports.
>     Information regarding the bug processing system
>     for package maintainers and bug triagers
>     
> 
> [3] 

Thanks!

-- 
肖盛文 xiao sheng wen -- Debian Developer(atzlinux)
Debian QA page: https://qa.debian.org/developer.php?login=atzlinux%40debian.org
GnuPG Public Key: 0x00186602339240CB



OpenPGP_signature.asc
Description: OpenPGP digital signature

Bug#1110370: stardict-plugin: YouDao plugin sends the user's selection from other apps to Chinese servers

[Max Nikulin]

On Mon, 4 Aug 2025 10:27:01 +0800 xiao sheng wen wrote:

Control: tags -1 - security
Control: Severity -1 wishlist


Xiao Sheng Wen, shouldn't severity be higher for this bug?

I think, you set "wishlist" because network dictionaries and scanning 
X11 selection are important features for users who need to quickly 
translate words and do it frequently. I agree in general, but privacy 
should be respected as well. The security team has restored the 
"security" tag already.


I would consider to set severity at least to "important". Higher value 
causes package removal from testing, and I do not find it reasonable.


In [1] Vincent wrote that apt-listbugs warns users about issues with 
severity "serious" and above. In my opinion, users should be notified 
about this bug before installing the packages. Accordingly to [2] it is 
possible to set "forky-ignore" and maybe "bookworm-ignore" tags to 
prevent removal of the packages from Debian repositories.


If the release team approve adding "ignore" tags, will you agree to 
raise severity to "serious"?


Original severity "critical" likely is not appropriate since the 
security team added: " (Minor issue)" [3].


I really hope that with cooperation from the upstream developers, it is 
possible to keep all features convenient for users, but to avoid issues 
related to privacy in default configuration.


[1] Vincent Lefevre to debian-user.
Re: Security: Be careful with StarDict!
Fri, 8 Aug 2025 15:29:17 +0200.
 



[2] Tags for bug reports.
Information regarding the bug processing system
for package maintainers and bug triagers


[3] 

Bug#1110370: stardict-plugin: YouDao plugin sends the user's selection from other apps to Chinese servers

[肖盛文]

在 2025/8/4 22:45, Vincent Lefevre 写道:
> On 2025-08-04 22:40:48 +0800, xiao sheng wen(肖盛文) wrote:
>> split stardict-plugin package, all of Internet dictionary plugin split to
>> a new package, for example, it's name is stardict-plugin-network-dictionary.
>> And in this new package description, show a "warning", tell user, etc,.
> 
> Note that a new package description will not be sufficient as
> a "warning" on machines where the end user is different from
> the admin (typically on multi-user machines).
> 
The package description can read by any user,
include the end normal user and the admin(root) user.

-- 
肖盛文 xiao sheng wen -- Debian Developer(atzlinux)
Debian QA page: https://qa.debian.org/developer.php?login=atzlinux%40debian.org
GnuPG Public Key: 0x00186602339240CB



OpenPGP_signature.asc
Description: OpenPGP digital signature

Bug#1110370: stardict-plugin: YouDao plugin sends the user's selection from other apps to Chinese servers

[Vincent Lefevre]

On 2025-08-04 22:40:48 +0800, xiao sheng wen(肖盛文) wrote:
> split stardict-plugin package, all of Internet dictionary plugin split to
> a new package, for example, it's name is stardict-plugin-network-dictionary.
> And in this new package description, show a "warning", tell user, etc,.

Note that a new package description will not be sufficient as
a "warning" on machines where the end user is different from
the admin (typically on multi-user machines).

-- 
Vincent Lefèvre  - Web: 
100% accessible validated (X)HTML - Blog: 
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)

Bug#1110370: stardict-plugin: YouDao plugin sends the user's selection from other apps to Chinese servers

[肖盛文]

Hi,

在 2025/8/4 16:40, Vincent Lefevre 写道:
> On 2025-08-04 13:39:37 +0800, xiao sheng wen(肖盛文) wrote:
>> The stardict-gtk package is set Recommends: stardict-plugin now, it's not 
>> set Depends on stardict-plugin. 
> 
> The point is that Recommends are installed by default.
> 
> But this is not the whole point. Features with privacy concerns
> should never be enabled by default (unless the feature is the
> only purpose of the package, and such a package would never be
> installed automatically -- and even in such a case, there should
> be a big warning first).

split stardict-plugin package, all of Internet dictionary plugin split to
a new package, for example, it's name is stardict-plugin-network-dictionary.
And in this new package description, show a "warning", tell user, etc,.

But I am not sure whether it's very necessary to do so. 

> 
> Here, I had originally installed StarDict many years ago, just
> to be able to use the Littré dictionary (stardict-xmlittre)
> from the application.
> 

Regards,
-- 
肖盛文 xiao sheng wen -- Debian Developer(atzlinux)
Debian QA page: https://qa.debian.org/developer.php?login=atzlinux%40debian.org
GnuPG Public Key: 0x00186602339240CB



OpenPGP_signature.asc
Description: OpenPGP digital signature

Bug#1110370: stardict-plugin: YouDao plugin sends the user's selection from other apps to Chinese servers

[Vincent Lefevre]

On 2025-08-04 13:39:37 +0800, xiao sheng wen(肖盛文) wrote:
> The stardict-gtk package is set Recommends: stardict-plugin now, it's not 
> set Depends on stardict-plugin. 

The point is that Recommends are installed by default.

But this is not the whole point. Features with privacy concerns
should never be enabled by default (unless the feature is the
only purpose of the package, and such a package would never be
installed automatically -- and even in such a case, there should
be a big warning first).

Here, I had originally installed StarDict many years ago, just
to be able to use the Littré dictionary (stardict-xmlittre)
from the application.

-- 
Vincent Lefèvre  - Web: 
100% accessible validated (X)HTML - Blog: 
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)

Bug#1110370: stardict-plugin: YouDao plugin sends the user's selection from other apps to Chinese servers

[肖盛文]

Hi,

在 2025/8/4 10:40, Vincent Lefevre 写道:
> On 2025-08-04 10:27:01 +0800, xiao sheng wen(肖盛文) wrote:
>> It has not attached screenshot in this bug report. forget to attach?
> 
> Yes, now done.
This calendar is come from stardict_multi_cmd plugin.
> 
>>> Imagine what could happen when the user selects some confidential
>>> data...
>> Why the user selects some confidential data to query dictionary?
> 
> The application happens to be running. This is just pure crap behavior.
> 
>>> Such a "feature" should never be enabled by default!
>>
>> If user install stardict-plugin package, default enabled the plugin
>> of this package is better.
> 
> I did *not* install the stardict-plugin package. This package is
> installed as a dependency of stardict-gtk.
> 
The stardict-gtk package is set Recommends: stardict-plugin now, it's not 
set Depends on stardict-plugin. 


Regards,
-- 
肖盛文 xiao sheng wen -- Debian Developer(atzlinux)
Debian QA page: https://qa.debian.org/developer.php?login=atzlinux%40debian.org
GnuPG Public Key: 0x00186602339240CB



OpenPGP_signature.asc
Description: OpenPGP digital signature

Bug#1110370: stardict-plugin: YouDao plugin sends the user's selection from other apps to Chinese servers

[Vincent Lefevre]

On 2025-08-04 10:27:01 +0800, xiao sheng wen(肖盛文) wrote:
> It has not attached screenshot in this bug report. forget to attach?

Yes, now done.

> > Imagine what could happen when the user selects some confidential
> > data...
> Why the user selects some confidential data to query dictionary?

The application happens to be running. This is just pure crap behavior.

> > Such a "feature" should never be enabled by default!
> 
> If user install stardict-plugin package, default enabled the plugin
> of this package is better.

I did *not* install the stardict-plugin package. This package is
installed as a dependency of stardict-gtk.

-- 
Vincent Lefèvre  - Web: 
100% accessible validated (X)HTML - Blog: 
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)

Bug#1110370: stardict-plugin: YouDao plugin sends the user's selection from other apps to Chinese servers

[肖盛文]

Control: tags -1 - security
Control: Severity -1 wishlist

Hi,
在 2025/8/4 08:07, Vincent Lefevre 写道:
> Package: stardict-plugin
> Version: 3.0.7+git20220909+dfsg-6
> Severity: critical
> Tags: security
> X-Debbugs-Cc: Debian Security Team 
> 
> When I run "stardict", the following occurs:
> 
> The YouDao plugin opens a calendar in its own window (see attached
> screenshot). That's disturbing. What's the relation with a dictionary???
It has not attached screenshot in this bug report. forget to attach?

The stardict-plugin install many plugin for stardict.

YouDao plugin is one of them.

I guess the calendar is come from stardict_multi_cmd plugin(Multi Command 
virtual dictionary.),
user can disable this plugin in "Manage Plugins".

> 
> Moreover, it interferes with other applications, once I select
> some text, showing a similar calendar window. Worse, "strace"
> shows that it sends whatever the user selects on the net!!!
The stardict has "Scan" function, when user enable this function,
after user select some text, it will trigger stardict do translate for this 
selected text.

This function also show in the package description:

use apt show stardict-plugin, it listed:

  * Scanning mouse selection and showing pop-up windows with translation of
selected words

> 
> For instance, when I select "relation", strace shows:
> 
> 911565 write(16, "GET HTTP://dict.youdao.com/fsearch?q=relation 
> HTTP/1.0\r\nUser-Agent: Mozilla/4.0(compatible;MSIE 5.00;Windows 
> 98)\r\nAccept: */*\r\nHost: dict.youdao.com\r\nConnection: close\r\n\r\n", 
> 171) = 171
> 
> and also
> 
> 911565 write(17, "GET HTTP://dict.cn/ws.php?utf8=true&q=relation 
> HTTP/1.0\r\nUser-Agent: Mozilla/4.0(compatible;MSIE 5.00;Windows 
> 98)\r\nAccept: */*\r\nHost: dict.cn\r\nConnection: close\r\n\r\n", 164) = 164
Use Internet dictionary server to query, it's the function of these plugin.


> 
> Imagine what could happen when the user selects some confidential
> data...
Why the user selects some confidential data to query dictionary?


> 
> Such a "feature" should never be enabled by default!

If user install stardict-plugin package, default enabled the plugin of this 
package is better.
If user don't like one of these plugin, he can disable it by himself.




Regards,

-- 
肖盛文 xiao sheng wen -- Debian Developer(atzlinux)
Debian QA page: https://qa.debian.org/developer.php?login=atzlinux%40debian.org
Debian salsa: https://salsa.debian.org/atzlinux-guest
GnuPG Public Key: 0x00186602339240CB


OpenPGP_0x00186602339240CB.asc
Description: OpenPGP public key


OpenPGP_signature.asc
Description: OpenPGP digital signature

Bug#1110370: stardict-plugin: YouDao plugin sends the user's selection from other apps to Chinese servers

[Vincent Lefevre]

Package: stardict-plugin
Version: 3.0.7+git20220909+dfsg-6
Severity: critical
Tags: security
X-Debbugs-Cc: Debian Security Team 

When I run "stardict", the following occurs:

The YouDao plugin opens a calendar in its own window (see attached
screenshot). That's disturbing. What's the relation with a dictionary???

Moreover, it interferes with other applications, once I select
some text, showing a similar calendar window. Worse, "strace"
shows that it sends whatever the user selects on the net!!!

For instance, when I select "relation", strace shows:

911565 write(16, "GET HTTP://dict.youdao.com/fsearch?q=relation 
HTTP/1.0\r\nUser-Agent: Mozilla/4.0(compatible;MSIE 5.00;Windows 98)\r\nAccept: 
*/*\r\nHost: dict.youdao.com\r\nConnection: close\r\n\r\n", 171) = 171

and also

911565 write(17, "GET HTTP://dict.cn/ws.php?utf8=true&q=relation 
HTTP/1.0\r\nUser-Agent: Mozilla/4.0(compatible;MSIE 5.00;Windows 98)\r\nAccept: 
*/*\r\nHost: dict.cn\r\nConnection: close\r\n\r\n", 164) = 164

Imagine what could happen when the user selects some confidential
data...

Such a "feature" should never be enabled by default!

-- System Information:
Debian Release: 13.0
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'testing-security'), (500, 
'stable-updates'), (500, 'stable-security'), (500, 'stable-debug'), (500, 
'proposed-updates-debug'), (500, 'unstable'), (500, 'testing'), (500, 
'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 6.7.12-amd64 (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_WARN
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages stardict-plugin depends on:
ii  libc62.41-11
ii  libespeak-ng11.52.0+dfsg-5
ii  libflite12.2-7
ii  libgcc-s114.2.0-19
ii  libglib2.0-0t64  2.84.3-1
ii  libgucharmap-2-90-7  1:15.1.5-1+b1
ii  libstdc++6   14.2.0-19
ii  man-db   2.13.1-1
ii  ncal 12.1.8
ii  stardict-gtk 3.0.7+git20220909+dfsg-6

stardict-plugin recommends no packages.

Versions of packages stardict-plugin suggests:
pn  stardict-plugin-cal   
pn  stardict-plugin-espeak
pn  stardict-plugin-festival  
pn  stardict-plugin-fortune   
pn  stardict-plugin-info  
pn  stardict-plugin-spell 

-- no debconf information

-- 
Vincent Lefèvre  - Web: 
100% accessible validated (X)HTML - Blog: 
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)