Timing-safe comparisons:
- crypto.c: Replace memcmp with CRYPTO_memcmp for Secret equality,
require equal lengths before comparing
- remote_control.py: Constant-time password lookup to avoid leaking
valid passwords via dict hash timing
- file_transmission.py: Use hmac.compare_digest for bypass token
comparison instead of ==
Memory safety:
- child-monitor.c: Fix inverted condition in write_to_peer that
prevented memmove from ever executing on partial writes
- ibus_glfw.c: Null-terminate IBUS_ADDRESS copy to prevent string
overread when strlen >= PATH_MAX
- x11_window.c: Add NULL checks after realloc in clipboard/DnD
data handling (two sites)
- dnd.c: Cap accepted_mimes at 1MB to prevent unbounded growth,
fix realloc to not lose the original pointer on failure
- png-reader.c: Cast to size_t before multiplication to prevent
integer overflow on 32-bit platforms
Secrets hygiene:
- disk-cache.c: Zero encryption_key with explicit_bzero before free
Tar extraction hardening:
- tar.go: Validate hardlink targets against destination prefix to
prevent writing outside extraction directory
- tar.go: Strip setuid/setgid/sticky bits from extracted files
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
See 8ce25208c3
I dont know what it is with GNOME. Every single release they break
backward compatibility somewhere, somehow. They must have special
talents.
Fixes#5967
The ForwardKeyEvent ibus signal is used to maintain ordering between CommitText events and non-IME key events.
The ordering is important for Korean IMEs, where it automatically commits text whenever a character is fully composed. This is different from Chinese/Japanese IMEs, where user manually presses a key to commit each word.
Without this patch, kitty can't handle non-IME key events when used with ibus-hangul, which utilizes ForwardKeyEvent signal.
Without ForwardKeyEvent:
```
key | sequence of events from application's view
r | UpdatePreeditText 'ㄱ'
k | UpdatePreeditText '가'
1 | (receives the reply to ProcessKeyEvent call: "native_key: 0x31 release: 0 handled: 0")
| -> UpdatePreeditText ''
| -> CommitText '가'
```
Application receives "1가", which is incorrect.
With ForwardKeyEvent:
```
key | sequence of events from application's view
r | UpdatePreeditText 'ㄱ'
k | UpdatePreeditText '가'
1 | (receives the reply to ProcessKeyEvent call: "native_key: 0x31 release: 0 handled: 1", and kitty discards the event)
| -> UpdatePreeditText ''
| -> CommitText '가'
| -> ForwardKeyEvent keysym=0x31("1")
```
Application receives "가1", which is correct.
Relevant ibus-hangul github issue to implement ForwardKeyEvent: https://github.com/libhangul/ibus-hangul/issues/42
Relevant changes in Qt to handle ForwardKeyEvent: https://codereview.qt-project.org/c/qt/qtbase/+/212179, https://codereview.qt-project.org/c/qt/qtbase/+/255587
fcitx5 works fine with kitty, except that when you restart fcitx5, kitty stop working with fcitx5, because the dbus_connection_get_is_connected(ibus->conn) in #check_connection is always true when you use fcitx5.
this patch add a dbus name owner changed detection to detect the online status of ibus, in case the ibus backend uses the session bus, like fcitx5.
This is required when the actual dbus is not from ibus but session bus.
This may happen when other run a shim layer for ibus, or ibus is
running with flatpak mode.
