diff options
| author | David Faure <faure@kde.org> | 2019-08-07 09:35:36 +0200 |
|---|---|---|
| committer | David Faure <faure@kde.org> | 2019-08-07 16:04:18 +0200 |
| commit | 5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22 (patch) | |
| tree | aa66599bc0c94f979ae78183cb9d0dd99d92bf45 /autotests/kconfigtest.cpp | |
| parent | 8e82d5accb52eda7bec784de447a9cb6161bbbb8 (diff) | |
| download | kconfig-5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22.tar.gz kconfig-5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22.tar.bz2 | |
Security: remove support for $(...) in config keys with [$e] marker.
Summary:
It is very unclear at this point what a valid use case for this feature
would possibly be. The old documentation only mentions $(hostname) as
an example, which can be done with $HOSTNAME instead.
Note that $(...) is still supported in Exec lines of desktop files,
this does not require [$e] anyway (and actually works better without it,
otherwise the $ signs need to be doubled to obey kconfig $e escaping rules...).
Test Plan:
ctest passes; various testcases with $(...) in desktop files,
directory files, and config files, no longer execute commands.
Reviewers: mdawson, aacid, broulik, davidedmundson, kossebau, apol, sitter, security-team
Reviewed By: mdawson, davidedmundson
Subscribers: ZaWertun, rikmills, fvogt, ngraham, kde-frameworks-devel
Tags: #frameworks
Differential Revision: https://phabricator.kde.org/D22979
Diffstat (limited to 'autotests/kconfigtest.cpp')
| -rw-r--r-- | autotests/kconfigtest.cpp | 10 |
1 files changed, 2 insertions, 8 deletions
diff --git a/autotests/kconfigtest.cpp b/autotests/kconfigtest.cpp index 410b5b80..9af3b464 100644 --- a/autotests/kconfigtest.cpp +++ b/autotests/kconfigtest.cpp @@ -38,7 +38,7 @@ #include <utime.h> #endif #ifndef Q_OS_WIN -#include <unistd.h> // gethostname +#include <unistd.h> // getuid #endif KCONFIGGROUP_DECLARE_ENUM_QOBJECT(KConfigTest, Testing) @@ -546,14 +546,8 @@ void KConfigTest::testPath() QCOMPARE(group.readPathEntry("withBraces", QString()), QString("file://" + HOMEPATH)); QVERIFY(group.hasKey("URL")); QCOMPARE(group.readEntry("URL", QString()), QString("file://" + HOMEPATH)); -#if !defined(Q_OS_WIN32) && !defined(Q_OS_MAC) - // I don't know if this will work on windows - // This test hangs on OS X QVERIFY(group.hasKey("hostname")); - char hostname[256]; - QVERIFY(::gethostname(hostname, sizeof(hostname)) == 0); - QCOMPARE(group.readEntry("hostname", QString()), QString::fromLatin1(hostname)); -#endif + QCOMPARE(group.readEntry("hostname", QString()), QStringLiteral("(hostname)")); // the $ got removed because empty var name QVERIFY(group.hasKey("noeol")); QCOMPARE(group.readEntry("noeol", QString()), QString("foo")); |