Disable dictionary dialogs and input gesture dialog in secure mode

[seanbudd]

Thank you @CyrilleB79 and @paulber19 for reporting

Link to issue number:

GitHub Advisory GHSA-wg65-7r23-h6p9: GHSA-wg65-7r23-h6p9

Summary of the issue:

The following menu items are hidden from the menu in secure mode:

• Input gesture
• Default dictionary
• Voice dictionary

However it is still possible to assign gestures to the scripts allowing to open these dialogs.

Gestures being set on the system profile may "pollute" public configuration.
If unexpected gestures or speech is being replaced, a user may be unable to sign-in to Windows.

Description of how this pull request fixes the issue:

For these commands, return early without opening the dialog if NVDA runs in secure mode.

Testing strategy:

Manual test:

• Assign 3 gestures to the scripts allowing to open the Input gesture dialog, the Default dictionary dialog and the Voice dictionary dialog.
• Copy your config to secure screens
• Run NVDA in secure mode and checked that these scripts do nothing.
• Run NVDA in normal mode and checked that each of these scripts opens the expected dialog.

Known issues with pull request:

None

Change log entries:

Security fixes

- Addressed security advisory ``GHSA-wg65-7r23-h6p9``. (#13489)
  - Remove the ability to open the input gestures dialog in secure mode.
  - Remove the ability to open the default, temporary and voice dictionary dialogs in secure mode.
  -

Code Review Checklist:

• Pull Request description:
  • description is up to date
  • change log entries
• Testing:
  • Unit tests
  • System (end to end) tests
  • Manual testing
• API is compatible with existing add-ons.
• Documentation:
  • User Documentation
  • Developer / Technical Documentation
  • Context sensitive help for GUI changes
• UX of all users considered:
  • Speech
  • Braille
  • Low Vision
  • Different web browsers
  • Localization in other languages / culture than English

[seanbudd]

The advisory will be published after the patch release is published.

[seanbudd]

@lukaszgo1 @XLTechie many of the assumptions in this comment are incorrect. The security advisory, when published, should make the security implications clear.
I will look at addressing this comment once the patch release is done, and @XLTechie has had a chance to understand the issue and this PR better.

[feerrenrut]

I'm locking this conversation and removing the comments. Please wait for the security advisory to be released on Monday. This will explain the situation. If you still would like to discuss further at this point, we'll start a discussion for it.