.desktop file security

[Shaun McCance]

On Tue, 2009-02-24 at 13:29 +0100, Alexander Larsson wrote:
> On Tue, 2009-02-24 at 11:13 +0000, John Tapsell wrote:
> > 2009/2/24 Alexander Larsson <alexl at redhat.com>:
> > > On Sat, 2009-02-21 at 18:07 -0500, Michael Pyne wrote:
> > >> If the file is made executable automatically it is given a
> > >> "#!/usr/bin/env xdg-open" header as well if it did not already have a
> > >> #! header so that running the file from the command line will do the
> > >> right thing.
> > >
> > > While this is a "neat trick" I don't really think its a good idea.
> > > First of all it will conflict a bit with mimetype sniffing (of course,
> > > this is disabled in the common file case as per above, but its useful in
> > > e.g. a text editor for selecting syntax highlighting rules).
> > 
> > It's dangerous not to.  If it's marked as executable, and you execute
> > it, it will try to be parsed by bash.  Most of the time this will just
> > generate lots of "file not found" errors as bash tries to understand
> > it, but it seems pretty dangerous to rely on this!
> 
> Really, even if there is no #!/bin/sh ? How does it know to pick bash as
> the interpreter for files like this?

I get this:

$ cat foo.desktop 
[Desktop Entry]
Name=foo
Exec=zenity --info --text=foo

$ ./foo.desktop
./foo.desktop: line 1: [Desktop: command not found
./foo.desktop: line 3: --info: command not found

Which certainly looks like it's being interpreted by sh.
Not entirely sure how it manages that without a shebang.
If we don't want people to execute these files normally,
we could always put #!/bin/false at the top.

--
Shaun