Disallow @@ and @@u magic tokens in desktop files #4156
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If we add new features analogous to file forwarding later, we might find that we need a different magic token. Let's reserve the whole @@* namespace so we can call it @@something-else. Signed-off-by: Simon McVittie <smcv@collabora.com>
This is either a malicious/compromised app trying to do an attack, or a mistake that will break handling of %f, %u and so on. Either way, if we refuse to export the .desktop file, resulting in installation failing, then it makes the rejection more obvious than quietly removing the magic tokens. Signed-off-by: Simon McVittie <smcv@collabora.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Disallow
@@and@@uusage in desktop filesFrom: @refi64
Fixes CVE-2021-21381: Arbitrary file read/write without permissions via special token in .desktop file #4146.
dir: Reserve the whole
@@prefixIf we add new features analogous to file forwarding later, we might
find that we need a different magic token. Let's reserve the whole
@@*namespace so we can call it@@something-else.dir: Refuse to export .desktop files with suspicious uses of
@@tokensThis is either a malicious/compromised app trying to do an attack, or
a mistake that will break handling of %f, %u and so on. Either way,
if we refuse to export the .desktop file, resulting in installation
failing, then it makes the rejection more obvious than quietly
removing the magic tokens.
This is a revised version of #4148, incorporating my suggestions. With this version, installing the app fails:
cc @refi64 @matthiasclasen