.desktop files, serious security hole, virus-friendliness

[Rodney Dawes]

On Mon, 2006-04-03 at 15:24 +0100, Scott James Remnant wrote:
> On Mon, 2006-04-03 at 09:48 -0400, Rodney Dawes wrote:
> 
> > On Sun, 2006-04-02 at 22:29 -0700, Sam Watkins wrote:
> > > 1. do you agree that this is a serious security problem?
> > 
> > I don't think it is a serious security problem. While it does expose
> > the ability to run shell commands from the .desktop file, it doesn't
> > seem likely that many people will do it. I mean, Windows has had
> > shortcut files which are pretty much exactly the same as our .desktop
> > files, and you never hear of anyone doing specific attacks like you
> > suggest would be done. There are much more interesting ways to do them,
> > than to have a .desktop file with an icon/label that lies about itself.
> > 
> Uh, PIF file attacks were very common for a long time in Windows.

Uhm. They weren't actually PIF files. They were executables with
the .pif extension. The same thing was done with .scr, which Windows
uses for screensavers. This is because Windows has been historically
bad at distinguishing file types by means other than extension. Surely
our Shared MIME Information spec, and the implementations based on it
have resolved this issue, and if you simply name a binary or shell
script as foo.desktop, it will show up in the file manager/everywhere
else, as an executable file or shell script, with the appropriate MIME
icon, no?

-- dobey