At a glance

1 · What is claimed?

• ConfirmedReproducible: the lock password field keeps up to Qt's default 32767 characters (no maximumLength in LockView.qml) and reports all of them to the service
• Not confirmedAffects the lock component

2 · What does it affect?

AreaIn the audited arealock· Decided by agents · verified

• RequirementWhen entered password text exceeds the field width, the… SW-REQ-260912-WBS3
• Componentlock

3 · Is it reproducible?

An engine-executed run exited 1 and showed the defect signal. See reproducer

4 · What remains unclear?

• Open question for maintainers: Open decision: should the lock screen limit the length of a typed or pasted password, and where? Options: (A) keep the current behaviour, no limit of its own (Qt's default 32767 in the field); (B) a maximum in the password field, value chosen by the maintainers; (C) also reject over-long values in the lock service before PAM (the report's ask; PR #10082 proposes B and C).
• Open question for maintainers: The decision is the Omarchy maintainers'; a draft requirement listing these options sits on this report's branch (report/cmulr91070k6l1gw401lz9v1z), and approving one option = merging that draft into the baseline with the chosen text.
• Affects the lock component — no requirement of the lock component is confirmed as violated

5 · What happens next?

Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. So far: in the audited area (lock) — decided by agents · verified; not a duplicate of another report — decided by agents · verified; matches no known issue — decided by agents · verified. The outcome (valid, duplicate, not a bug, …) is not decided yet. See the decision.

Open question — draft spec awaiting a decision

Original report

### System details

Omarchy 4

### What's wrong?

the lock/authentication surface still hard resource bounds:

LockView.qml:113-120,170-213 accepts an unbounded password and constructs a matching repeated-character TextMetrics string. Clipboard/keyboard input can therefore force unbounded allocation and layout work on the lock screen. Enforce a small explicit maximum length before storing, measuring, or sending the value to PAM.

Service.qml:188-207 forwards that unbounded value into the PAM flow. Apply the same limit at this service boundary as defense in depth and clear/reject oversized input before assigning pendingPassword.

The recurring authentication/helper processes (Service.qml:221-239,369-399) have no explicit attempt/deadline budget. In particular, failed fingerprint authentication is retried every 250 ms for the entire lock duration. Add a bounded retry/backoff policy and a deadline/recovery path so a broken PAM/fprint service cannot create an indefinite tight authentication loop.

Validation

Reproducer

bash test/reports/report-cmulr91070k6l1gw401lz9v1z.sh

AS-REPORTED: the lock field applies no limit of its own: it takes up to Qt's default 32767 characters and reports them all to the service

Observed on this tree (quickshell 0.3.1, lock plugin shell/plugins/lock):
  - the password TextInput's maximumLength is 32767 (Qt's built-in default; LockView.qml sets none)
  - inserting 513 characters leaves 513 in the field; passwordTextEdited reports 513 characters; the masking TextMetrics measures 513 dots
  - inserting 4096 characters leaves 4096 in the field; passwordTextEdited reports 4096 characters; the masking TextMetrics measures 4096 dots
  - inserting 100000 characters leaves 32767 in the field; passwordTextEdited reports 32767 characters; the masking TextMetrics measures 32767 dots
AS-REPORTED: the lock field applies no limit of its own: it takes up to Qt's default 32767 characters and reports them all to the service

Linked

• Related toR-830Fingerprint unlock rejected on first attempt after resume (Goodix, race with sleep-lock inhibitor)· decided by agents · verified
• Related PRpr/10082· confirmed

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.