<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style> </head> <body dir="ltr"> <div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div id="appendonsend"></div> <div class="elementToProof" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> On Tuesday, June 25, 2024 12:42 PM, meator <meator.dev@gmail.com></div> <div class="elementToProof" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div class="elementToProof" style="font-size: 11pt;">> On 6/25/24 18:13, Bollinger, John wrote:<br> > > > I have also messaged this mailing list about this<br> > > > (See "A few questions about escaping in desktop files" sent in 22.<br> > > > August 2022). In this thread, I was assured that the implementation can<br> > > > either choose to do word splitting and unquoting itself or it can pass<br> > > > the job to a shell.<br> > ><br> > > I do not find that surprising, but the spec really ought to be clear<br> > > about it.<br> ><br> > [...] all of this is still<br> > speculation I believe. But I found the arguments made on that thread<br> > reasonable.<br> ><br> > I have reread the thread (it has been two years since I've discussed<br> > this). Here's a link if you're curious:</div> <div class="elementToProof" style="font-size: 11pt;">> <a href="https://lists.freedesktop.org/archives/xdg/2022-August/014620.html" target="_blank" id="OWA412d7467-0813-94e9-22f1-ffae1ebbc5e5" class="OWAAutoLink" rel="noopener noreferrer" data-auth="NotApplicable"> https://lists.freedesktop.org/archives/xdg/2022-August/014620.html</a></div> <div class="elementToProof" style="font-size: 11pt;">><br> > The argument made is that there already exist two major implementations<br> > handling the Exec key either way. This means that both the shell<br> > approach and the manual approach "are correct", because if they aren't,<br> > it would make a major implementation not compliant, which would make the<br> > specification less reliable and it would anger other implementers too.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">I think where you say "less reliable", it would be more apt to say "unacceptable</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">to the overall community". And even if it were not the original intent that</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">both approaches should be acceptable, if that is the de facto interpretation</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">then that's the position from which any changes or interpretations must be</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">made. Though in truth, I have trouble reading the spec as intending otherwise.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt;">> > ---<br> > ><br> > > [spec draft] ><br> > > ---<br> <br> I +1 your efforts. It would be nice to see clarification in the<br> specification. You also impose stricter rules on quoting which would<br> make passing the arguments to the shell feasible.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">The way I see it, no, I don't. On one hand, none of the specifics laid out in</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">that draft wording are rules in their own right. They are all _consequences_</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">of the general rule that an implementation should have its choice of</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">running the command via a shell or parsing the command line and</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">exec()ing the result directly. On the other hand, that general rule seems</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">to convey the prevailing interpretation of the spec, so even though some</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">of those specifics are not spelled out in the current spec, they are</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">nevertheless implied by it anyway.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt;">> This would remove<br> behavior discrepancies between the shell approach and the manual approach.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">Yes, to the extent that there are any desktop files that actually trigger such</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">differences now. But I'm inclined to think that those tend to get ironed out</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">when a project gets bug reports about its desktop files not working with</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">one desktop environment or another. Which is another reason to take what</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">I describe as a more explicit expression of the de facto requirements of the</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">current spec, rather than as conveying any new or fundamentally different</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">requirements.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt;">> One disadvantage I see is that the entire shell quoting mechanism has to</div> <div class="elementToProof" style="font-size: 11pt;">> be specified here.</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);"><br> </div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">No, it doesn't. In fact, it _isn't_ (believe it or not) in the draft wording I</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">presented (see also below).</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);"><br> </div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">> Shell is not directly related to desktop files.</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">> Implementations choosing to handle the Exec key manually will not even<br> > involve a shell altogether. This imposes a pretty hard artificial<br> > dependency on the /bin/sh quoting mechanism.<br> </div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">Shell _is_ directly related to desktop files if it is a rule, whether explicit</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">or not, that the value of the Exec key needs to be interpretable in a</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">certain way by the shell. And although the spec doesn't say so</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">explicitly, I do, again, think that that is a de facto rule. Specifically,</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">as I expressed it in the draft text: "commands must be quoted and</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">escaped such that their interpretation according to the shell's rules</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">does not differ from their interpretation according to the more</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">limited delimiting, quoting, and escaping rules presented in this</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">specification."</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);"><br> </div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">However, having expressed that rule in the spec, it would be possible to</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">provide less precise guidance on how to satisfy that, closer in style to</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">the current quoting rules. One needs to understand, however, that</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">the current rules are inadequate for their apparent intended purpose.</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">If we are interpreting that purpose correctly then that is a deeper flaw</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">in the spec than just not covering square brackets, yet one that I don't</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">think would be a major issue to fix, even if the change could be</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">interpreted as backwards incompatible.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt;">> the main issue I've outlined in the<br> > originating e-mail of this thread is globbing.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">Yes, I know and understand.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt;">> Implementations using the<br> > shell for handling of Exec will treat the following line:<br> ><br> > > Exec=/usr/bin/xte[r]m<br> ><br> > as /usr/bin/xterm (if xterm is installed on the system in the expected<br> > location). This is true unless these implementations employ special code<br> > for [, which is not likely, because it is not specified.<br> </div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">Yes.</div> <div class="elementToProof" style="font-size: 11pt;"><br> > Implementations doing word splitting and unquoting manually will see<br> > /usr/bin/xte[r]m,</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"> Yes.</div> <div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"> <br> </div> <div class="elementToProof" style="font-size: 11pt;">> which is arguably the correct behavior.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">Maybe. Inasmuch as I perceive a de facto rule that Exec values must be</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">quoted appropriately to ensure that there is no such difference in</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">interpretation, I would argue that that Exec value is non-conforming.</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">If it appeared in a real desktop file, I would find it eminently reasonable</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">to file a bug report about that with the project providing that file.</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);"><br> </div> <div class="elementToProof" style="font-size: 11pt;"><span style="color: rgb(0, 0, 0);">> </span>If the desktop file should choose to invoke [ (as in /usr/bin/[), I</div> <div class="elementToProof" style="font-size: 11pt;">> believe that no special treatment is necessary.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt;">Agreed. And the general rule I keep coming back to is consistent with</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">that.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt;">> I would also like to point out that "real" desktop files used in<br> > production will never contain these special edge-cases were discussing.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">Provisionally agreed. Certainly I don't expect ever to see anything</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">analogous to Exec=/usr/bin/xte[r]m. But I'm not so quick to accept</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">that I shouldn't expect ever to see *any* real-world example that satisfies</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">the explicit quoting rules in the current version of the spec, but</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">nevertheless is handled differently by different desktop environments.</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">Such an example probably wouldn't involve square brackets, but I</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">am in no way so sure about shell reserved words, for example.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt;">> But still, the specification should be clear.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">Yes. I may just submit a PR with some variation of my draft revision,</div> <div class="elementToProof" style="font-size: 11pt; color: rgb(0, 0, 0);">and see what happens.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt;">> Because of this thread and because of other concerns, I chose to switch<br> > the Exec handling mechanism of j4-dmenu-desktop (a desktop file runner<br> > program I maintain) from the shell approach to the manual one.<br> </div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt;">Although that puts more work on the desktop file launcher, I do think</div> <div class="elementToProof" style="font-size: 11pt;">it's the preferable approach. I never like to get a shell involved unless it's</div> <div class="elementToProof" style="font-size: 11pt;">really needed.</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt;">Best,</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <div class="elementToProof" style="font-size: 11pt;">John</div> <div class="elementToProof" style="font-size: 11pt;"><br> </div> <br> <hr> <font face="Arial" color="Gray" size="2"><br> Email Disclaimer: www.stjude.org/emaildisclaimer<br> Consultation Disclaimer: www.stjude.org/consultationdisclaimer<br> </font> </body> </html>