Bug 21018

Summary:	xdg-utils incorrectly parses output, causing wrong output
Product:	Portland	Reporter:	jamie
Component:	xdg-utils	Assignee:	Fathi Boudra <fabo>
Status:	RESOLVED MOVED	QA Contact:
Severity:	normal
Priority:	medium	Keywords:	patch
Version:	unspecified
Hardware:	Other
OS:	All
URL:	https://bugs.edge.launchpad.net/ubuntu/+source/xdg-utils/+bug/335643
Whiteboard:
i915 platform:		i915 features:
Attachments:	Patch from Ubuntu bug

Description jamie 2009-04-02 14:17:43 UTC

This bug was reported in the Ubuntu bug tracker as a security vulnerability. I do not feel it is a security vulnerability because it appears xdg-mime will at worst echo back the filename rather than the mimetype. Eg, from within a gnome session:

$ touch '/tmp/foo:runme'
$ KDE_FULL_SESSION=false GNOME_DESKTOP_SESSION_ID= xdg-mime query filetype /tmp/foo\:runme
runme

This is simply because info_kde(), info_gnome() and info_generic() use cut with a delimiter that if in the filename, causes unintended output. See the Ubuntu bug for details and a suggested patch.

xdg-utils 1.0.2 (1.0.2-6.1 on Ubuntu and Debian)

Comment 1 Andrew Starr-Bochicchio 2010-07-08 11:04:59 UTC

Created attachment 36854 [details] [review]
Patch from Ubuntu bug

Comment 2 dunric29a 2013-01-27 19:25:32 UTC

I can confirm the issue is still not fixed in xdg-utils 1.1.0, git snapshot from 2012-10-08.
Attached patch does work for me.
Please update in upstream.

Comment 3 GitLab Migration User 2019-02-16 13:29:39 UTC

-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/xdg/xdg-utils/issues/31.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.