diff options
| author | David Faure <faure@kde.org> | 2019-08-07 09:35:36 +0200 |
|---|---|---|
| committer | l10n daemon script <scripty@kde.org> | 2019-08-07 20:04:08 +0000 |
| commit | 01674d7d5b1d8d0f21193f00265bf923fda71dc1 (patch) | |
| tree | 8c366adfc1663bdfd9a51e0cb48be367f595d716 /autotests/kconfigtest.cpp | |
| parent | 768127df473777d4272fb59948ac0c34a959f4ec (diff) | |
| download | kconfig-5.61.0-rc2.tar.gz kconfig-5.61.0-rc2.tar.bz2 | |
Security: remove support for $(...) in config keys with [$e] marker.v5.61.0-rc2v5.61.0
Summary:
It is very unclear at this point what a valid use case for this feature
would possibly be. The old documentation only mentions $(hostname) as
an example, which can be done with $HOSTNAME instead.
Note that $(...) is still supported in Exec lines of desktop files,
this does not require [$e] anyway (and actually works better without it,
otherwise the $ signs need to be doubled to obey kconfig $e escaping rules...).
Test Plan:
ctest passes; various testcases with $(...) in desktop files,
directory files, and config files, no longer execute commands.
Reviewers: mdawson, aacid, broulik, davidedmundson, kossebau, apol, sitter, security-team
Reviewed By: mdawson, davidedmundson
Subscribers: ZaWertun, rikmills, fvogt, ngraham, kde-frameworks-devel
Tags: #frameworks
Differential Revision: https://phabricator.kde.org/D22979
(cherry picked from commit 5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22)
Diffstat (limited to 'autotests/kconfigtest.cpp')
| -rw-r--r-- | autotests/kconfigtest.cpp | 10 |
1 files changed, 2 insertions, 8 deletions
diff --git a/autotests/kconfigtest.cpp b/autotests/kconfigtest.cpp index 410b5b80..9af3b464 100644 --- a/autotests/kconfigtest.cpp +++ b/autotests/kconfigtest.cpp @@ -38,7 +38,7 @@ #include <utime.h> #endif #ifndef Q_OS_WIN -#include <unistd.h> // gethostname +#include <unistd.h> // getuid #endif KCONFIGGROUP_DECLARE_ENUM_QOBJECT(KConfigTest, Testing) @@ -546,14 +546,8 @@ void KConfigTest::testPath() QCOMPARE(group.readPathEntry("withBraces", QString()), QString("file://" + HOMEPATH)); QVERIFY(group.hasKey("URL")); QCOMPARE(group.readEntry("URL", QString()), QString("file://" + HOMEPATH)); -#if !defined(Q_OS_WIN32) && !defined(Q_OS_MAC) - // I don't know if this will work on windows - // This test hangs on OS X QVERIFY(group.hasKey("hostname")); - char hostname[256]; - QVERIFY(::gethostname(hostname, sizeof(hostname)) == 0); - QCOMPARE(group.readEntry("hostname", QString()), QString::fromLatin1(hostname)); -#endif + QCOMPARE(group.readEntry("hostname", QString()), QStringLiteral("(hostname)")); // the $ got removed because empty var name QVERIFY(group.hasKey("noeol")); QCOMPARE(group.readEntry("noeol", QString()), QString("foo")); |