From 5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22 Mon Sep 17 00:00:00 2001 From: David Faure Date: Wed, 7 Aug 2019 09:35:36 +0200 Subject: Security: remove support for $(...) in config keys with [$e] marker. Summary: It is very unclear at this point what a valid use case for this feature would possibly be. The old documentation only mentions $(hostname) as an example, which can be done with $HOSTNAME instead. Note that $(...) is still supported in Exec lines of desktop files, this does not require [$e] anyway (and actually works better without it, otherwise the $ signs need to be doubled to obey kconfig $e escaping rules...). Test Plan: ctest passes; various testcases with $(...) in desktop files, directory files, and config files, no longer execute commands. Reviewers: mdawson, aacid, broulik, davidedmundson, kossebau, apol, sitter, security-team Reviewed By: mdawson, davidedmundson Subscribers: ZaWertun, rikmills, fvogt, ngraham, kde-frameworks-devel Tags: #frameworks Differential Revision: https://phabricator.kde.org/D22979 --- autotests/kconfigtest.cpp | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) (limited to 'autotests/kconfigtest.cpp') diff --git a/autotests/kconfigtest.cpp b/autotests/kconfigtest.cpp index 410b5b80..9af3b464 100644 --- a/autotests/kconfigtest.cpp +++ b/autotests/kconfigtest.cpp @@ -38,7 +38,7 @@ #include #endif #ifndef Q_OS_WIN -#include // gethostname +#include // getuid #endif KCONFIGGROUP_DECLARE_ENUM_QOBJECT(KConfigTest, Testing) @@ -546,14 +546,8 @@ void KConfigTest::testPath() QCOMPARE(group.readPathEntry("withBraces", QString()), QString("file://" + HOMEPATH)); QVERIFY(group.hasKey("URL")); QCOMPARE(group.readEntry("URL", QString()), QString("file://" + HOMEPATH)); -#if !defined(Q_OS_WIN32) && !defined(Q_OS_MAC) - // I don't know if this will work on windows - // This test hangs on OS X QVERIFY(group.hasKey("hostname")); - char hostname[256]; - QVERIFY(::gethostname(hostname, sizeof(hostname)) == 0); - QCOMPARE(group.readEntry("hostname", QString()), QString::fromLatin1(hostname)); -#endif + QCOMPARE(group.readEntry("hostname", QString()), QStringLiteral("(hostname)")); // the $ got removed because empty var name QVERIFY(group.hasKey("noeol")); QCOMPARE(group.readEntry("noeol", QString()), QString("foo")); -- cgit v1.2.1