Reply box accepts rich text input

[eloquence]

The client currently accepts rich text input in the reply box, e.g., via copy and paste:

While such input will be filtered when sending a reply, it should not be accepted at all, i.e. the reply box should act similar to an HTML <textarea>, treating all input as plain text.

[deeplow]

This might be simple fix: sed -i 's/QTextEdit/QPlainTextEdit/g' securedrop_client/gui/widgets.py

[ninavizz]

@eloquence Why shouldn't this accept rich text? I could see journalists liking this bug as a feature, tbh.

[eloquence]

• HTML is less safe to deal with than plain text and creates potential injection vectors for JavaScript or other malicious code. This is probably close to a dealbreaker issue for adding such functionality unless it's critically needed.
• SecureDrop will not currently accept or render such replies and would need to be modified to do so (server-side change).
• A rich-text control without any obvious way to disable or use it (e.g., toolbar) is of dubious value and more likely to cause random surprises when copying text from other contexts (exactly like the odd random icon in that screenshot).

[ninavizz]

Cool, cool...

Your third point i was mostly curious about receiving feedback on, in the pilot; also somewhat expecting the user-surprise factor, but curious nonetheless. The first two points sound like clear dealbreakers to me, too, though... so, nevermind!

Ignore the ux kid waving her hands in the corner, and sortie-forth with debugging!