<html>
    <head>
      <base href="https://bugs.freedesktop.org/">
    </head>
    <body><table border="1" cellspacing="0" cellpadding="8">
        <tr>
          <th>Bug ID</th>
          <td><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW - xdg-desktop-menu uninstall /nonexistent/*.directory /nonexistent/*.desktop removes unrelated files"
   href="https://bugs.freedesktop.org/show_bug.cgi?id=105635">105635</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>xdg-desktop-menu uninstall /nonexistent/*.directory /nonexistent/*.desktop removes unrelated files
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>Portland
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>unspecified
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>All
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>Linux (All)
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>NEW
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>major
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>medium
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>xdg-utils
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>portland-bugs@lists.freedesktop.org
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>marmarek@mimuw.edu.pl
          </td>
        </tr></table>
      <p>
        <div>
        <pre>Providing arguments to xdg-desktop-menu with wildcards (not expanded by shell -
either because of quoting, or missing files) expand them internally, but
ignoring directory part of the argument. This results in operation on unrelated
files.

The most extreme case is: xdg-desktop-menu uninstall /nonexistent/*.directory
/nonexistent/*.desktop
This results in removing all files from /usr/share/desktop-directories and
/usr/share/applications.
While this behavior could be expected (if documented!) for just "*.desktop"
argument, certainly it isn't when there was a full path provided.

Looks like missing quoting here:

        uninstall)
            for x in $xdg_dir $kde_dir $gnome_dir ; do
                rm -f $x/$basefile  # <- here
            done

(this fragment appears twice in the script - once for directory files and once
for desktop files)

Version: xdg-utils 1.1.1 (Fedora 26).

BTW I recommend running shellcheck on this (and other) script, it detects
problems like this:
In /usr/bin/xdg-desktop-menu line 1411:
                rm -f $x/$basefile
                      ^-- SC2086: Double quote to prevent globbing and word
splitting.
                         ^-- SC2086: Double quote to prevent globbing and word
splitting.</pre>
        </div>
      </p>


      <hr>
      <span>You are receiving this mail because:</span>

      <ul>
          <li>You are the assignee for the bug.</li>
      </ul>
    </body>
</html>