Dear Maintainer,

    Problem: Very DANGEROUS BUG in gnome-disk-utility : USER COULD POSSIBLY
DELETE THE HARD DISK BY MISTAKE WITHOUT GIVING ANY PASSWORD.

    Hi,

    I have discovered a very dangerous bug in gnome-disk-utility.
    I am now on debian 11 bullseye testing and that bug was already present on
debian 10 buster stable and probably before too.

    Usage process :
    - We use gnome-disk-utility (graphical interface) and we want to copy an
ISO image on a USB stick.
    - We insert our USB stick, we click on USB on the left of the gnome-disk-
utility window.
    - We then choose the "Restore Disk Image..." (translation of the french
"Restaurer l'image disque...".
    - When we have chosen the ISO file to put on the USB stick, the software
comes with a window that says "Begin restoration..." (translation of the french
"Demarrer la restauration...".
    - We click on "Demarrer la restauration" and then another window says
"Cancel/Restore" (french : "Annuler/Restaurer").
    - We click on "Restore" (french "Restaurer") and the software asks us for
necessary authentification (password) (french "Authentification necessaire").

    BUG :
    At that point, EVEN IF WE CLICK "CANCEL" (french "ANNULER"), THE USB STICK
IS ERASED, it is formatted anyway.
    And a big concern is : What would have happened if, by mistake we had
clicked on the hard disk (HDD) instead of the USB stick as a destination for
our ISO image ?? It would certainly have been erased too, without even having
given any password !! A child or inattentive, tired person could erase the hard
disk that way.
    I tested that several times with a USB stic), but having just one computer,
I couldn't test that bug with the Hard Disk. And I don't know if there is a
protection for preventing the user to select the Hard Disk instead of a USB
stick.

    Cordially,
    Pascal.

Hi,

thanks for reporting this but it is not a dangerous bug because the disk
wiping in your case on the USB stick could have been done anyway without
password while for system drives this always requires a password.

The confusing behavior in GNOME Disks is that it always wipes the drive
after encountering an error during the restore image operation, but also
treated authentification errors the same way.

I made a patch to skip the disk wiping in case the authentification
dialog was dismissed:

https://gitlab.gnome.org/GNOME/gnome-disk-utility/-/merge_requests/43

In the future, please report directly to upstream. I just found this bug
report by chance.
(Also, since UDisks is responsible for the authentification: if it were
possible to overwrite arbitrary drives without a password, then it
should have been a UDisks bug report, not a GNOME Disks bug report.)

Regards,
Kai

P.S.: Your second response is an HTML message which is only shown on the
bug tracker web UI as an attachment.