Ricochet Refresh - UI Redressing / Shared File Names can contained HTML

Users can share files with names that contain a restricted subset of HTML (see: https://doc.qt.io/qt-6/richtext-html-subset.html - this allows the remote peer some degree of control over the messaging page, including the ability to format text and links and potentially include images.

Note: Image inclusion is limited because RR rejects files containing forward slashes, and by default QML assumes the URI is a qrc resource (and there are no images in the default qrc root) - however I've not done extensive testing here so I wouldn't rule out the possibility of being able to load an image using this method (locally or otherwise).

• log sec-research privacy-research