summaryrefslogtreecommitdiffstats
path: root/tdecore/tdeconfigbase.cpp
diff options
context:
space:
mode:
authorSlávek Banko <slavek.banko@axis.cz>2019-08-08 02:45:03 +0200
committerSlávek Banko <slavek.banko@axis.cz>2019-08-08 03:15:54 +0200
commit1074eb033654bd5462677ffe694eda7805390284 (patch)
treec1e4a37007d39c7e2f82d912be55a4e587a8e7a4 /tdecore/tdeconfigbase.cpp
parent38198900a49c5fe8cb9c7e9a9af9bba858e30f39 (diff)
downloadtdelibs-1074eb033654bd5462677ffe694eda7805390284.tar.gz
tdelibs-1074eb033654bd5462677ffe694eda7805390284.zip
Security: remove support for $(...) in config keys with [$e] marker.
It is very unclear at this point what a valid use case for this feature would possibly be. The old documentation only mentions $(hostname) as an example, which can be done with $HOSTNAME instead. Note that $(...) is still supported in Exec lines of desktop files, this does not require [$e] anyway (and actually works better without it, otherwise the $ signs need to be doubled to obey tdeconfig $e escaping rules...). Based on KDE Frameworks 5 kconfig patch for CVE-2019-14744. This resolves issue #45. Signed-off-by: Slávek Banko <slavek.banko@axis.cz>
Diffstat (limited to 'tdecore/tdeconfigbase.cpp')
-rw-r--r--tdecore/tdeconfigbase.cpp21
1 files changed, 1 insertions, 20 deletions
diff --git a/tdecore/tdeconfigbase.cpp b/tdecore/tdeconfigbase.cpp
index 1e8310a74..340afdfe4 100644
--- a/tdecore/tdeconfigbase.cpp
+++ b/tdecore/tdeconfigbase.cpp
@@ -276,26 +276,7 @@ TQString TDEConfigBase::readEntry( const char *pKey,
while( nDollarPos != -1 && nDollarPos+1 < static_cast<int>(aValue.length())) {
// there is at least one $
- if( (aValue)[nDollarPos+1] == '(' ) {
- uint nEndPos = nDollarPos+1;
- // the next character is no $
- while ( (nEndPos <= aValue.length()) && (aValue[nEndPos]!=')') )
- nEndPos++;
- nEndPos++;
- TQString cmd = aValue.mid( nDollarPos+2, nEndPos-nDollarPos-3 );
-
- TQString result;
- FILE *fs = popen(TQFile::encodeName(cmd).data(), "r");
- if (fs)
- {
- {
- TQTextStream ts(fs, IO_ReadOnly);
- result = ts.read().stripWhiteSpace();
- }
- pclose(fs);
- }
- aValue.replace( nDollarPos, nEndPos-nDollarPos, result );
- } else if( (aValue)[nDollarPos+1] != '$' ) {
+ if( (aValue)[nDollarPos+1] != '$' ) {
uint nEndPos = nDollarPos+1;
// the next character is no $
TQString aVarName;