<html> <head> <base href="https://bugs.freedesktop.org/" /> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW - xdg-open does not handle x-schemes with no URL correctly (suggested PATCH)" href="https://bugs.freedesktop.org/show_bug.cgi?id=86340#c2">Comment # 2</a> on <a class="bz_bug_link bz_status_NEW " title="NEW - xdg-open does not handle x-schemes with no URL correctly (suggested PATCH)" href="https://bugs.freedesktop.org/show_bug.cgi?id=86340">bug 86340</a> from <a class="email" href="mailto:infinite.craziness@gmail.com" title="Aayla Secura <infinite.craziness@gmail.com>"> Aayla Secura</a> <pre>(In reply to Rex Dieter from <a href="show_bug.cgi?id=86340#c1">comment #1</a>) > Re: legacy/applnk support > > I'd rather you not conflate that here, to deal with it in a separate patch. > In doing so, I'd also opt for dropping applnk support rather than adding it. > > And, let's deal with quoting separately too please. Is there some reason > you opted for this approach rather than what I proposed in <a class="bz_bug_link bz_status_NEW " title="NEW - xdg-open: command injection vulnerability" href="show_bug.cgi?id=66670">bug #66670</a> > already? > > While you're at it, please add patches as attachments rather than inline > > And, thanks. Sorry, I wasn't sure if I should post separate patches, my main idea was to fix the handling of schemes with empty URLs. As for the applnk - I wasn't sure if it should be dropped completely, but it bugged me that it was supported in one function and not the rest. As for the quoting - as far as I could see, you wrapped all the arguments in single quotes at the point of evaluation - that causes several problems: some of those arguments (that are specified in the desktop file) may be options to the programs (for example --writer in libreoffice's dekstop file) and if they are put in single quotes it causes an error; that's why I only wrapped the argument provided by the user in single quotes; secondly, if that argument (path to file or url or whatever) contains a single quote, it is not escaped (hence I replace any single quote with '"'"' before wrapping the whole arg in single quotes) Your code does however fix the issue with %i and %c, which I forgot to adress. Sorry, new to bugzilla in general, will post patches as attachments from now on :) (is there a way to edit my comment to remove the patch?)</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the assignee for the bug.</li> </ul> </body> </html>