Security: remove support for $(...) in KRun which could have allowed

execution of malicious code. This is similar to issue #45 for .desktop
files.

Signed-off-by: Michele Calgaro <michele.calgaro@yahoo.it>
(cherry picked from commit 8b8f5064f7)
r14.0.x
Michele Calgaro 5 years ago
parent a781ccd72c
commit ef4c56c613
Signed by: MicheleC
GPG Key ID: 2A75B7CA8ADED5CF

@ -931,26 +931,7 @@ void KRun::init()
while( nDollarPos != -1 && nDollarPos+1 < static_cast<int>(aValue.length())) {
// there is at least one $
if( (aValue)[nDollarPos+1] == '(' ) {
uint nEndPos = nDollarPos+1;
// the next character is no $
while ( (nEndPos <= aValue.length()) && (aValue[nEndPos]!=')') )
nEndPos++;
nEndPos++;
TQString cmd = aValue.mid( nDollarPos+2, nEndPos-nDollarPos-3 );
TQString result;
FILE *fs = popen(TQFile::encodeName(cmd).data(), "r");
if (fs)
{
{
TQTextStream ts(fs, IO_ReadOnly);
result = ts.read().stripWhiteSpace();
}
pclose(fs);
}
aValue.replace( nDollarPos, nEndPos-nDollarPos, result );
} else if( (aValue)[nDollarPos+1] != '$' ) {
if( (aValue)[nDollarPos+1] != '$' ) {
uint nEndPos = nDollarPos+1;
// the next character is no $
TQString aVarName;

Loading…
Cancel
Save