<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
On Tuesday, June 25, 2024 2:32 AM, <span style="font-family: Calibri, sans-serif; font-size: 11pt;">
meator <meator.dev@gmail.com> wrote:</span></div>
<div id="divRplyFwdMsg" dir="ltr" class="elementToProof">
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
> Before I react, I should mention that you appear to be replying to me<br>
> specifically and not to the mailing list.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Oops.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
> I do not know whether this is<br>
> intentional or not, but I will assume it is and I will not CC the</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
> mailing list. But it would be nice if this discussion would be included<br>
> in the mailing list to allow others to react to it.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I include the list this time.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
> On 6/20/24 16:36, Bollinger, John wrote:<br>
> > Hello,<br>
> ><br>
> > The spec is less than forthcoming about the purpose for quotation in the<br>
> > values of Exec keys. On one hand, the spec says that the value of an<br>
> > Exec key should be a "command line", and the rules for it do seem<br>
> > consistent with handing off the command to a shell for execution. On the<br>
> > other hand, the spec doesn't actually require "command lines" to be<br>
> > executed via a shell at all, and if they were, the spec doesn't say<br>
> > which one or even which family of them. It makes no promise that any<br>
> > redirections or command-line expansions that a shell might perform will<br>
> > in fact be done, except that it does require quote removal and<br>
> > protection of erstwhile quoted arguments from being split into multiple<br>
> > arguments afterward.<br>
><br>
> [...] I am well aware of the ambiguity of the specification. I<br>
> have assumed that this ambiguity is intentional, that the authors of the<br>
> specification choose to not specify how exactly shall the program is<br>
> executed. [...]</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
That's plausible, and I have considered the possibility myself.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
> I have also messaged this mailing list about this<br>
> (See "A few questions about escaping in desktop files" sent in 22.<br>
> August 2022). In this thread, I was assured that the implementation can<br>
> either choose to do word splitting and unquoting itself or it can pass<br>
> the job to a shell.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I do not find that surprising, but the spec really ought to be clear about it.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
And it should present the quoting rules as a consequence of that freedom,</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
not standalone requirements. That would have mooted the present discussion,</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
and if implemented, it might yet moot some future ones. Something like this,</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
for example:</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
---</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
The Exec key</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
The Exec key must contain a command line. A command line consists of</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
an executable program name, optionally followed by one or more arguments,</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
all separated from each other by unquoted spaces. The program</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
name can be specified either as an absolute path or as a simple name,</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
without any path. If no path is provided then the executable is identified by</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Looking it up in the executable search path used by the desktop environment.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
The program name and arguments may each be quoted in whole, by enclosing</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
them in double quotes and escaping any double-quote characters within.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Arbitrary other characters may be escaped as well (see also below).</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
The desktop environment is permitted to execute command lines by</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
presenting them as literal input to the system's default shell (/bin/sh), by</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
parsing the command line itself and exec()ing the result, or by other, similar</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
means of its choosing. Therefore, commands must be quoted and escaped</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
such that their interpretation according to the shell's rules does not</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
differ from their interpretation according to the more limited delimiting,</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
quoting, and escaping rules presented in this specification. Among the</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
implications are:</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
- if the program name contains an equals sign ("=") then either it must</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
be quoted or the equals sign must be escaped.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
- the program name must be quoted or escaped if it is a shell reserved word</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
("!", "{", "}", "case", "do", "done", "elif", "else", "esac", "fi", "for", "if", "in",</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
"then", "until", "while").</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
- Where the program name or any argument starts with a tilde ("~")</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
character, either the whole must be quoted or the tilde must be escaped.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
- shell metacharacters and operators anywhere in the command line must be</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
quoted or escaped. For this purpose, it suffices to quote or escape every</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
appearance of each of these characters: vertical bar ("|"), ampersand ("&"),</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
semicolon (";"), parentheses ("(" and ")"), less-than sign ("<"),</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
greater-than sign (">"), tab, newline, and spaces (other than those meant</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
to separate the program name and arguments from each other).</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
- The double quote (when representing itself), backslash ("\"), dollar</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
sign ("$"), and backtick ("`") characters anywhere in the command line</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
must be escaped. Quoting these is not sufficient.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
- The comment-start ("#") and single quote ("'") characters appearing</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
anywhere in the command line must be quoted or escaped.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
- Characters and character combinations meaningful for pathname</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
expansion must be quoted or escaped anywhere they appear in the</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
command line. These include the asterisk ("*"), question mark ("?"),</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
and matched pairs of square brackets ("[", "]").</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Note that the general escape rule for values of type string also states that</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
the backslash character can be escaped as ("\\"), and that this escape rule</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
is applied before the quoting rule. As such, to represent a literal</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
backslash character in a quoted argument in a desktop entry file requires</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
the use of four successive backslash characters ("\\\\"). Likewise, a literal</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
dollar sign in a quoted argument in a desktop entry file is represented</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
with ("\\$"). </div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[... field codes ...]</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
---</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
> [...] the<br>
> [ character is missing from the reserved characters, which means that<br>
> all implementations using the shell for execution very likely result in<br>
> unintended behavior for desktop files which contain [ in an unquoted<br>
> argument of Exec.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Possibly. [ itself is a standard external command, equivalent to "test".</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
It is used frequently for that purpose in shell conditional commands. And</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
even when not appearing as a command name, unquoted [ still represents</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
itself unless paired with a matching ]. I speculate that that may explain why</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
[ is not on the must-be-quoted list. But that would be another good reason</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
for being more explicit about how the Exec key can be used, and to discuss</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
quoting in that context, instead of as standalone requirements.</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Best,</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
John Bollinger</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="2"><br>
Email Disclaimer: www.stjude.org/emaildisclaimer<br>
Consultation Disclaimer: www.stjude.org/consultationdisclaimer<br>
</font>
</body>
</html>