blob: 621687c59d245e9967f6c6980068a1d87da30aff (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
From f32002ce50edc3891f1fa41173132c820b917d57 Mon Sep 17 00:00:00 2001
From: Marco Martin <notmart@gmail.com>
Date: Mon, 5 Feb 2018 13:12:51 +0100
Subject: [PATCH] Make sure device paths are quoted
in the case a vfat removable device has $() or `` in its label,
such as $(touch foo) the quoted command may get executed,
leaving an attack vector. Use KMacroExpander::expandMacrosShellQuote
to make sure everything is quoted and not interpreted as a command
BUG:389815
---
soliduiserver/deviceserviceaction.cpp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/soliduiserver/deviceserviceaction.cpp b/soliduiserver/deviceserviceaction.cpp
index f49c967a..738b27c8 100644
--- a/soliduiserver/deviceserviceaction.cpp
+++ b/soliduiserver/deviceserviceaction.cpp
@@ -158,7 +158,7 @@ void DelayedExecutor::delayedExecute(const QString &udi)
QString exec = m_service.exec();
MacroExpander mx(device);
- mx.expandMacros(exec);
+ mx.expandMacrosShellQuote(exec);
KRun::runCommand(exec, QString(), m_service.icon(), 0);
deleteLater();
--
2.13.6
|
