<html> <head> <base href="https://bugs.freedesktop.org/" /> </head> <body> <div> <a class="bz_bug_link bz_status_RESOLVED bz_closed" title="RESOLVED FIXED - xdg-open: command injection vulnerability" href="https://bugs.freedesktop.org/show_bug.cgi?id=66670#c16">Comment # 16</a> on <a class="bz_bug_link bz_status_RESOLVED bz_closed" title="RESOLVED FIXED - xdg-open: command injection vulnerability" href="https://bugs.freedesktop.org/show_bug.cgi?id=66670">bug 66670</a> from <a class="email" href="mailto:geert@kobaltwit.be" title="Geert Janssens <geert@kobaltwit.be>"> Geert Janssens</a> <pre>I'm confused. How exactly can I verify the patch is fixing the arbitrary command injection vulnerability ? I have installed xdg-utils-1.1.0-0.35.rc3.fc20, which should carry the patch. However the test command DE="generic" XDG_CURRENT_DESKTOP="" xdg-open '<a href="http://127.0.0.1/$(xterm">http://127.0.0.1/$(xterm</a>)' START /usr/bin/chromium-browser "<a href="http://127.0.0.1/$(xterm">http://127.0.0.1/$(xterm</a>)" opens en xterm both before I installed the test package and after. I would have thought that the new package was supposed open my default browser (being firefox). The package that was installed before the update was xdg-utils.noarch 0:1.1.0-0.31.rc2.fc20</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the assignee for the bug.</li> </ul> </body> </html>