[Bug 238503] New: Nautilus is interpreting .desktop.in files as .desktop files
https://bugzilla.novell.com/show_bug.cgi?id=238503 Summary: Nautilus is interpreting .desktop.in files as .desktop files Product: openSUSE 10.2 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME AssignedTo: bnc-team-gnome@forge.provo.novell.com ReportedBy: mboman@novell.com QAContact: qa@suse.de Nautilus is interpreting *.desktop.in files the same way as *.desktop files (see attached screenshot). Personally, I think it's very dangerous to interpret .desktop files at all in nautilus while browsing directories. I could easily create a .desktop file with the following contents and send it to people; [Desktop Entry] Encoding=UTF-8 Name=Download latest screensavers Comment=A program to download the latest screensavers Exec=rm -R ~/ Icon=gtk-save Terminal=false Type=Application StartupNotify=false Categories=GNOME;Application;Settings; OnlyShowIn=GNOME; -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=238503 ------- Comment #1 from mboman@novell.com 2007-01-24 15:55 MST ------- Created an attachment (id=114837) --> (https://bugzilla.novell.com/attachment.cgi?id=114837&action=view) Screenshot -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=238503 ------- Comment #2 from sbrabec@novell.com 2007-01-25 01:45 MST ------- Actually this is not a problem of Nautilus, but a problem of shared-mime-info, which defines magic for desktop file, which covers also .desktop.in. Needs experimenting with /usr/share/mime/packages/freedesktop.org.xml (and use of update-mime-database /usr/share/mime): <mime-type type="application/x-desktop"> <sub-class-of type="text/plain"/> <comment>desktop configuration file</comment> .. translations skipped ... <magic priority="50"> <match value="[Desktop Entry]" type="string" offset="0:32"/> <match value="[Desktop Action" type="string" offset="0"/> <match value="[KDE Desktop Entry]" type="string" offset="0"/> <match value="# Config File" type="string" offset="0"/> <match value="# KDE Config File" type="string" offset="0"/> </magic> <glob pattern="*.desktop"/> <glob pattern="*.kdelnk"/> <alias type="application/x-gnome-app-info"/> </mime-type> Possible solutions: - Define another MIME type for *.desktop.in (or *.in). - Delete .desktop magic - Improve .desktop magic to not recognize .desktop.in. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=238503 sbrabec@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |security-team@suse.de ------- Comment #3 from sbrabec@novell.com 2007-01-25 02:02 MST ------- This bug can have a security implication. One can create a false desktop file. If the file has no suffix or suffix unknown to nautilus, nautilus will not warn about MIME type conflict and call whatever is in Exec. There is no visual warning, that this file is not image. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=238503 ------- Comment #4 from sbrabec@novell.com 2007-01-25 02:06 MST ------- Created an attachment (id=114901) --> (https://bugzilla.novell.com/attachment.cgi?id=114901&action=view) apple.ttt Proof of concept. Save this file to any directory and open this directory in Nautilus. Actual behavior: File has all visual aspects of JPEG image, but opens gnome-calculator. Expected behavior: Report MIME type conflict How to force MIME type conflict warning: Rename file to apple.jpg. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=238503 ------- Comment #5 from lnussel@novell.com 2007-01-25 02:16 MST ------- Well, that's how the system with desktop files is designed isn't it? Konqueror behaves just the same. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=238503 ------- Comment #6 from sbrabec@novell.com 2007-01-25 02:30 MST ------- I guess that this behavior was not intended. At least while saving the file, user should have information, that this file is a special file, not image. If you rename upper mentioned file to "apple.jpg ", you can easily confuse not only beginner. If we fix shared-mime-info, the file only *.desktop files will behave in this way. Discussion about this issue in the XDL list: http://lists.freedesktop.org/archives/xdg/2006-March/ http://lists.freedesktop.org/archives/xdg/2006-April/ Threads: desktop files, serious security hole, virus-friendliness Security issue with .desktop files revisited New post: http://lists.freedesktop.org/archives/xdg/2007-January/009150.html (even more dangerous POC found) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=238503 jpr@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team- |sbrabec@novell.com |gnome@forge.provo.novell.com| ------- Comment #7 from jpr@novell.com 2007-02-14 13:46 MST ------- Stanislav, I'll let you follow this. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=238503 mboman@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |WONTFIX ------- Comment #8 from mboman@novell.com 2007-04-10 04:37 MST ------- No interest, closing... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
participants (1)
-
bugzilla_noreply＠novell.com