gh-icsharpcode/AvalonEdit

Watch

Fork 0

Fix read-only bypass via Cut/Delete context menu commands (Issue #444) #450

Open

JyslaFancy wants to merge 1 commit from JyslaFancy/fix/issue-444-cut-enabled-when-readonly into master

JyslaFancy commented

2026-06-12 18:23:16 -05:00

(Migrated from github.com)

Description

Fixes #444: Cut and Delete commands remain enabled in context menu when IsReadOnly=true.

Vulnerability

When , the Cut and Delete commands remained enabled in the context menu and via keyboard shortcuts (Ctrl+X, Del). This allowed bypassing the read-only protection — a user could delete or move content from a read-only document.

Root Cause

The handlers for Cut () and Delete () only checked whether text was selected. They never verified that the document was writable via .

Fix

CanCutOrCopy: Now checks when the command is . Copy (which also uses ) remains unaffected — copying from read-only documents is legitimate.
CanDelete: Now requires in addition to having a non-empty selection.
CanPaste: Already correctly validated via — no changes needed.

Attack Vector

Context menu or keyboard shortcut (Ctrl+X, Del) on a read-only with selected text.

## Description Fixes #444: Cut and Delete commands remain enabled in context menu when IsReadOnly=true. ### Vulnerability When , the **Cut** and **Delete** commands remained enabled in the context menu and via keyboard shortcuts (Ctrl+X, Del). This allowed bypassing the read-only protection — a user could delete or move content from a read-only document. ### Root Cause The handlers for Cut () and Delete () only checked whether text was selected. They never verified that the document was writable via . ### Fix - **CanCutOrCopy**: Now checks when the command is . Copy (which also uses ) remains unaffected — copying from read-only documents is legitimate. - **CanDelete**: Now requires in addition to having a non-empty selection. - **CanPaste**: Already correctly validated via — no changes needed. ### Attack Vector Context menu or keyboard shortcut (Ctrl+X, Del) on a read-only with selected text.

This pull request is broken due to missing fork information.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin 'JyslaFancy/fix/issue-444-cut-enabled-when-readonly:JyslaFancy/fix/issue-444-cut-enabled-when-readonly'

git switch 'JyslaFancy/fix/issue-444-cut-enabled-when-readonly'

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch 'master'

git merge --no-ff 'JyslaFancy/fix/issue-444-cut-enabled-when-readonly'

git switch 'JyslaFancy/fix/issue-444-cut-enabled-when-readonly'

git rebase 'master'

git switch 'master'

git merge --ff-only 'JyslaFancy/fix/issue-444-cut-enabled-when-readonly'

git switch 'JyslaFancy/fix/issue-444-cut-enabled-when-readonly'

git rebase 'master'

git switch 'master'

git merge --no-ff 'JyslaFancy/fix/issue-444-cut-enabled-when-readonly'

git switch 'master'

git merge --squash 'JyslaFancy/fix/issue-444-cut-enabled-when-readonly'

git switch 'master'

git merge --ff-only 'JyslaFancy/fix/issue-444-cut-enabled-when-readonly'

git switch 'master'

git merge 'JyslaFancy/fix/issue-444-cut-enabled-when-readonly'

git push origin 'master'

No reviewers

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-icsharpcode/AvalonEdit!450

No description provided.

Rows
Columns