<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><span class="vcard"><a class="email" href="mailto:guriev-ns@ya.ru" title="Nicholas Guriev <guriev-ns@ya.ru>"> <span class="fn">Nicholas Guriev</span></a>
</span> changed
<a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - Argument injection in xdg-open open_envvar"
href="https://bugs.freedesktop.org/show_bug.cgi?id=103807">bug 103807</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>guriev-ns@ya.ru
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - Argument injection in xdg-open open_envvar"
href="https://bugs.freedesktop.org/show_bug.cgi?id=103807#c17">Comment # 17</a>
on <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - Argument injection in xdg-open open_envvar"
href="https://bugs.freedesktop.org/show_bug.cgi?id=103807">bug 103807</a>
from <span class="vcard"><a class="email" href="mailto:guriev-ns@ya.ru" title="Nicholas Guriev <guriev-ns@ya.ru>"> <span class="fn">Nicholas Guriev</span></a>
</span></b>
<pre>Created <span class=""><a href="attachment.cgi?id=139640" name="attach_139640" title="Another patch">attachment 139640</a> <a href="attachment.cgi?id=139640&action=edit" title="Another patch">[details]</a></span> <a href='page.cgi?id=splinter.html&bug=103807&attachment=139640'>[review]</a>
Another patch
Please consider this patch of the latest version 1.1.3. It fixes the issue in
another way. First a content of the $browser variable is split into separate
arguments, then the %s placeholder for printf is replaced with a URL while
keeping spaces that are passed to a browser in a single argument. So we avoid
passing extra parameters.
An advantage of this approach is that xdg-open doesn't display irrelevant error
message "no method available ..." (Something like "invalid argument" would be
more appropriate). This preserves the current behavior, and the utility still
tries to open even a slightly invalid URL.
The patch uses positional parameters for deal with arguments list to achieve
portability. Also I've added an auto-test of this vulnerability.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>