Blender leaks potentially sensitive user information. #102161

New Issue

Will · 2022-10-30T12:52:07+01:00

Will commented

2022-10-30 12:52:07 +01:00

System Information
Operating system: Linux

Blender Version
Broken: 3.3, 3.0, 2.49
Worked: Presumably never.

Short description of error

Blender embeds a bunch of filepaths in the files it saves, usually including the user home as well as the full path to the file, which likely includes the real name of the user, and I suppose may reveal certain aspects of system configuration.

Exact steps for others to reproduce the error

Save an empty/default startup file somewhere under your user home directory.
$ strings BlenderFile.blend | grep /

Sometimes there's a lot of complicated paths that reveal much of my home directory structure. Sometimes there's only one or two and they're quite short.

This happens even when manually invoking save_as_mainfile().

**System Information** Operating system: Linux **Blender Version** Broken: 3.3, 3.0, 2.49 Worked: Presumably never. **Short description of error** Blender embeds a bunch of filepaths in the files it saves, usually including the user home as well as the full path to the file, which likely includes the real name of the user, and I suppose may reveal certain aspects of system configuration. **Exact steps for others to reproduce the error** 1. Save an empty/default startup file somewhere under your user home directory. 2. `$ strings BlenderFile.blend | grep /` Sometimes there's a lot of complicated paths that reveal much of my home directory structure. Sometimes there's only one or two and they're quite short. This happens even when manually invoking `save_as_mainfile()`.

Will commented

2022-10-30 12:52:07 +01:00

Added subscriber: @WCN

Thomas Dinges commented

2022-10-31 09:22:04 +01:00

Added subscriber: @ThomasDinges

Omar Emara commented

2022-11-07 09:55:24 +01:00

Closed as duplicate of #45546

Omar Emara closed this issue

2022-11-07 09:55:24 +01:00

Campbell Barton commented

2022-11-08 07:27:39 +01:00

Added subscriber: @ideasman42

Campbell Barton commented

2022-11-08 07:27:39 +01:00

Firstly this isn't technically a bug, however looking into it - loading the default startup file is guaranteed to include the default directory (home or my-documents) of the user.

This would be understandable if the user opened a file select the and navigated to a directory, currently loading the startup file always writes this directory into the file selector.

So this is not quite the same as #45546, which relates to paths not being cleared in memory.

This patch postpones initializing file paths until the file selector is used. P3293

Firstly this isn't technically a bug, however looking into it - loading the default startup file is guaranteed to include the default directory (home or my-documents) of the user. This would be understandable if the user opened a file select the and navigated to a directory, currently loading the startup file always writes this directory into the file selector. So this is not quite the same as #45546, which relates to paths not being cleared in memory. --- This patch postpones initializing file paths until the file selector is used. [P3293](https://archive.blender.org/developer/P3293.txt)

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Blender leaks potentially sensitive user information. #102161