Security: remove support for $(...) in config keys with [$e] marker.
Summary: It is very unclear at this point what a valid use case for this feature would possibly be. The old documentation only mentions $(hostname) as an example, which can be done with $HOSTNAME instead. Note that $(...) is still supported in Exec lines of desktop files, this does not require [$e] anyway (and actually works better without it, otherwise the $ signs need to be doubled to obey kconfig $e escaping rules...). Test Plan: ctest passes; various testcases with $(...) in desktop files, directory files, and config files, no longer execute commands. Reviewers: mdawson, aacid, broulik, davidedmundson, kossebau, apol, sitter, security-team Reviewed By: mdawson, davidedmundson Subscribers: ZaWertun, rikmills, fvogt, ngraham, kde-frameworks-devel Tags: #frameworks Differential Revision: https://phabricator.kde.org/D22979
parent
8e82d5ac
Please register or sign in to comment