diff options
| author | David Faure <faure@kde.org> | 2019-08-07 09:35:36 +0200 |
|---|---|---|
| committer | l10n daemon script <scripty@kde.org> | 2019-08-07 20:04:08 +0000 |
| commit | 01674d7d5b1d8d0f21193f00265bf923fda71dc1 (patch) | |
| tree | 8c366adfc1663bdfd9a51e0cb48be367f595d716 /docs/options.md | |
| parent | 768127df473777d4272fb59948ac0c34a959f4ec (diff) | |
| download | kconfig-5.61.0-rc2.tar.gz kconfig-5.61.0-rc2.tar.bz2 | |
Security: remove support for $(...) in config keys with [$e] marker.v5.61.0-rc2v5.61.0
Summary:
It is very unclear at this point what a valid use case for this feature
would possibly be. The old documentation only mentions $(hostname) as
an example, which can be done with $HOSTNAME instead.
Note that $(...) is still supported in Exec lines of desktop files,
this does not require [$e] anyway (and actually works better without it,
otherwise the $ signs need to be doubled to obey kconfig $e escaping rules...).
Test Plan:
ctest passes; various testcases with $(...) in desktop files,
directory files, and config files, no longer execute commands.
Reviewers: mdawson, aacid, broulik, davidedmundson, kossebau, apol, sitter, security-team
Reviewed By: mdawson, davidedmundson
Subscribers: ZaWertun, rikmills, fvogt, ngraham, kde-frameworks-devel
Tags: #frameworks
Differential Revision: https://phabricator.kde.org/D22979
(cherry picked from commit 5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22)
Diffstat (limited to 'docs/options.md')
| -rw-r--r-- | docs/options.md | 11 |
1 files changed, 4 insertions, 7 deletions
diff --git a/docs/options.md b/docs/options.md index c634c000..4a6e9bc1 100644 --- a/docs/options.md +++ b/docs/options.md @@ -67,18 +67,15 @@ environment variables (and `XDG_CONFIG_HOME` in particular). Shell Expansion --------------- -If an entry is marked with `$e`, environment variables and shell commands will -be expanded. +If an entry is marked with `$e`, environment variables will be expanded. Name[$e]=$USER - Host[$e]=$(hostname) When the "Name" entry is read `$USER` will be replaced with the value of the -`$USER` environment variable, and `$(hostname)` will be replaced with the output -of the `hostname` command. +`$USER` environment variable. -Note that the application will replace `$USER` and `$(hostname)` with their -respective expanded values after saving. To prevent this combine the `$e` option +Note that the application will replace `$USER` with its +expanded value after saving. To prevent this combine the `$e` option with `$i` (immmutable) option. For example: Name[$ei]=$USER |