From 4150f6084e125ed37a1b2ce570be34a8402ce6cb Mon Sep 17 00:00:00 2001
From: Luke Hines <luke@hines.im>
Date: Sun, 19 Jul 2026 13:09:47 +0100
Subject: [PATCH 1/2] Sanitize session name on IPC sender side

---
 src/ipcmessage.h | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/ipcmessage.h b/src/ipcmessage.h
index 1aef6b2..c017b89 100644
--- a/src/ipcmessage.h
+++ b/src/ipcmessage.h
@@ -52,15 +52,16 @@ struct IpcMessage {
     }
 
     static QByteArray encode(const QString &execCommand, const QStringList &execArgs, const QString &sessionName) {
+        const QString cleanName = sanitizeSessionName(sessionName);
         if (!execCommand.isEmpty()) {
             QByteArray cmdBytes = execCommand.toUtf8();
             for (const QString &arg : execArgs) {
                 cmdBytes.append('\0');
                 cmdBytes.append(arg.toUtf8());
             }
-            return (QStringLiteral("exec:") + sessionName + QStringLiteral(":")).toUtf8() + cmdBytes + '\n';
-        } else if (!sessionName.isEmpty()) {
-            return (QStringLiteral("switch:") + sessionName + QStringLiteral("\n")).toUtf8();
+            return (QStringLiteral("exec:") + cleanName + QStringLiteral(":")).toUtf8() + cmdBytes + '\n';
+        } else if (!cleanName.isEmpty()) {
+            return (QStringLiteral("switch:") + cleanName + QStringLiteral("\n")).toUtf8();
         }
         return QByteArrayLiteral("raise\n");
     }

From 0b1bf29d63e8699c5bb88d4efcd6f9ed76bb6545 Mon Sep 17 00:00:00 2001
From: Luke Hines <luke@hines.im>
Date: Sun, 19 Jul 2026 13:09:47 +0100
Subject: [PATCH 2/2] Document CBC-without-MAC as intentional

---
 src/scrollencryptor.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/scrollencryptor.cpp b/src/scrollencryptor.cpp
index 3023a75..573bdb6 100644
--- a/src/scrollencryptor.cpp
+++ b/src/scrollencryptor.cpp
@@ -236,6 +236,7 @@ QByteArray ScrollEncryptor::encrypt(const QByteArray &plaintext)
     enc.setData(padded);
     enc.setInitializationVector(iv);
     enc.setKey(*m_keyReference);
+    // CBC without MAC is intentional: device-lock key, bit-flip malleability accepted.
     enc.setBlockMode(CryptoManager::BlockModeCbc);
     enc.setPadding(CryptoManager::EncryptionPaddingNone);
     enc.setCryptoPluginName(CryptoManager::DefaultCryptoStoragePluginName);