.desktop file security
shaunm at gnome.org
Tue Feb 24 08:48:57 PST 2009
On Tue, 2009-02-24 at 13:29 +0100, Alexander Larsson wrote:
> On Tue, 2009-02-24 at 11:13 +0000, John Tapsell wrote:
> > 2009/2/24 Alexander Larsson <alexl at redhat.com>:
> > > On Sat, 2009-02-21 at 18:07 -0500, Michael Pyne wrote:
> > >> If the file is made executable automatically it is given a
> > >> "#!/usr/bin/env xdg-open" header as well if it did not already have a
> > >> #! header so that running the file from the command line will do the
> > >> right thing.
> > >
> > > While this is a "neat trick" I don't really think its a good idea.
> > > First of all it will conflict a bit with mimetype sniffing (of course,
> > > this is disabled in the common file case as per above, but its useful in
> > > e.g. a text editor for selecting syntax highlighting rules).
> > It's dangerous not to. If it's marked as executable, and you execute
> > it, it will try to be parsed by bash. Most of the time this will just
> > generate lots of "file not found" errors as bash tries to understand
> > it, but it seems pretty dangerous to rely on this!
> Really, even if there is no #!/bin/sh ? How does it know to pick bash as
> the interpreter for files like this?
I get this:
$ cat foo.desktop
Exec=zenity --info --text=foo
./foo.desktop: line 1: [Desktop: command not found
./foo.desktop: line 3: --info: command not found
Which certainly looks like it's being interpreted by sh.
Not entirely sure how it manages that without a shebang.
If we don't want people to execute these files normally,
we could always put #!/bin/false at the top.
More information about the xdg