author | Felix Yan
<felixonmars@archlinux.org> 2019-08-11 08:39:59 UTC |
committer | Felix Yan
<felixonmars@archlinux.org> 2019-08-11 08:39:59 UTC |
parent | 8cbf9857d1755614eb337f492faf7ecce730a268 |
0001-Security-remove-support-for-.-in-config-keys-with-e-.patch | +0 | -145 |
PKGBUILD | +6 | -11 |
diff --git a/0001-Security-remove-support-for-.-in-config-keys-with-e-.patch b/0001-Security-remove-support-for-.-in-config-keys-with-e-.patch deleted file mode 100644 index 1ddeb54..0000000 --- a/0001-Security-remove-support-for-.-in-config-keys-with-e-.patch +++ /dev/null @@ -1,145 +0,0 @@ -From 5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22 Mon Sep 17 00:00:00 2001 -From: David Faure <faure@kde.org> -Date: Wed, 7 Aug 2019 09:35:36 +0200 -Subject: [PATCH] Security: remove support for $(...) in config keys with [$e] - marker. - -Summary: -It is very unclear at this point what a valid use case for this feature -would possibly be. The old documentation only mentions $(hostname) as -an example, which can be done with $HOSTNAME instead. - -Note that $(...) is still supported in Exec lines of desktop files, -this does not require [$e] anyway (and actually works better without it, -otherwise the $ signs need to be doubled to obey kconfig $e escaping rules...). - -Test Plan: -ctest passes; various testcases with $(...) in desktop files, -directory files, and config files, no longer execute commands. - -Reviewers: mdawson, aacid, broulik, davidedmundson, kossebau, apol, sitter, security-team - -Reviewed By: mdawson, davidedmundson - -Subscribers: ZaWertun, rikmills, fvogt, ngraham, kde-frameworks-devel - -Tags: #frameworks - -Differential Revision: https://phabricator.kde.org/D22979 ---- - autotests/kconfigtest.cpp | 10 ++-------- - docs/options.md | 11 ++++------- - src/core/kconfig.cpp | 37 +------------------------------------ - 3 files changed, 7 insertions(+), 51 deletions(-) - -diff --git a/autotests/kconfigtest.cpp b/autotests/kconfigtest.cpp -index 410b5b8..9af3b46 100644 ---- a/autotests/kconfigtest.cpp -+++ b/autotests/kconfigtest.cpp -@@ -38,7 +38,7 @@ - #include <utime.h> - #endif - #ifndef Q_OS_WIN --#include <unistd.h> // gethostname -+#include <unistd.h> // getuid - #endif - - KCONFIGGROUP_DECLARE_ENUM_QOBJECT(KConfigTest, Testing) -@@ -546,14 +546,8 @@ void KConfigTest::testPath() - QCOMPARE(group.readPathEntry("withBraces", QString()), QString("file://" + HOMEPATH)); - QVERIFY(group.hasKey("URL")); - QCOMPARE(group.readEntry("URL", QString()), QString("file://" + HOMEPATH)); --#if !defined(Q_OS_WIN32) && !defined(Q_OS_MAC) -- // I don't know if this will work on windows -- // This test hangs on OS X - QVERIFY(group.hasKey("hostname")); -- char hostname[256]; -- QVERIFY(::gethostname(hostname, sizeof(hostname)) == 0); -- QCOMPARE(group.readEntry("hostname", QString()), QString::fromLatin1(hostname)); --#endif -+ QCOMPARE(group.readEntry("hostname", QString()), QStringLiteral("(hostname)")); // the $ got removed because empty var name - QVERIFY(group.hasKey("noeol")); - QCOMPARE(group.readEntry("noeol", QString()), QString("foo")); - -diff --git a/docs/options.md b/docs/options.md -index c634c00..4a6e9bc 100644 ---- a/docs/options.md -+++ b/docs/options.md -@@ -67,18 +67,15 @@ environment variables (and `XDG_CONFIG_HOME` in particular). - Shell Expansion - --------------- - --If an entry is marked with `$e`, environment variables and shell commands will --be expanded. -+If an entry is marked with `$e`, environment variables will be expanded. - - Name[$e]=$USER -- Host[$e]=$(hostname) - - When the "Name" entry is read `$USER` will be replaced with the value of the --`$USER` environment variable, and `$(hostname)` will be replaced with the output --of the `hostname` command. -+`$USER` environment variable. - --Note that the application will replace `$USER` and `$(hostname)` with their --respective expanded values after saving. To prevent this combine the `$e` option -+Note that the application will replace `$USER` with its -+expanded value after saving. To prevent this combine the `$e` option - with `$i` (immmutable) option. For example: - - Name[$ei]=$USER -diff --git a/src/core/kconfig.cpp b/src/core/kconfig.cpp -index e1b11ed..f6824ce 100644 ---- a/src/core/kconfig.cpp -+++ b/src/core/kconfig.cpp -@@ -28,19 +28,6 @@ - #include <cstdlib> - #include <fcntl.h> - --#ifdef _MSC_VER --static inline FILE *popen(const char *cmd, const char *mode) --{ -- return _popen(cmd, mode); --} --static inline int pclose(FILE *stream) --{ -- return _pclose(stream); --} --#else --#include <unistd.h> --#endif -- - #include "kconfigbackend_p.h" - #include "kconfiggroup.h" - -@@ -183,29 +170,7 @@ QString KConfigPrivate::expandString(const QString &value) - int nDollarPos = aValue.indexOf(QLatin1Char('$')); - while (nDollarPos != -1 && nDollarPos + 1 < aValue.length()) { - // there is at least one $ -- if (aValue[nDollarPos + 1] == QLatin1Char('(')) { -- int nEndPos = nDollarPos + 1; -- // the next character is not $ -- while ((nEndPos <= aValue.length()) && (aValue[nEndPos] != QLatin1Char(')'))) { -- nEndPos++; -- } -- nEndPos++; -- QString cmd = aValue.mid(nDollarPos + 2, nEndPos - nDollarPos - 3); -- -- QString result; -- --// FIXME: wince does not have pipes --#ifndef _WIN32_WCE -- FILE *fs = popen(QFile::encodeName(cmd).data(), "r"); -- if (fs) { -- QTextStream ts(fs, QIODevice::ReadOnly); -- result = ts.readAll().trimmed(); -- pclose(fs); -- } --#endif -- aValue.replace(nDollarPos, nEndPos - nDollarPos, result); -- nDollarPos += result.length(); -- } else if (aValue[nDollarPos + 1] != QLatin1Char('$')) { -+ if (aValue[nDollarPos + 1] != QLatin1Char('$')) { - int nEndPos = nDollarPos + 1; - // the next character is not $ - QStringRef aVarName; diff --git a/PKGBUILD b/PKGBUILD index a9bdb75..e7cf7a9 100644 --- a/PKGBUILD +++ b/PKGBUILD @@ -3,8 +3,8 @@ # Contributor: Andrea Scarpino <andrea@archlinux.org> pkgname=kconfig -pkgver=5.60.0 -pkgrel=2 +pkgver=5.61.0 +pkgrel=1 pkgdesc='Configuration system' arch=(x86_64) url='https://community.kde.org/Frameworks' @@ -13,18 +13,13 @@ depends=(qt5-base) makedepends=(extra-cmake-modules qt5-tools clang python-pyqt5 doxygen sip) optdepends=('python-pyqt5: for the Python bindings') groups=(kf5) -source=("https://download.kde.org/stable/frameworks/${pkgver%.*}/$pkgname-$pkgver.tar.xz"{,.sig} - 0001-Security-remove-support-for-.-in-config-keys-with-e-.patch) -sha256sums=('541acceead9ca516e3562109e7e94351ce378c234bea968c8dfde78f00559233' - 'SKIP' - '1e885acaf3743e461bc958cc2d77ed7ca06280a4277fa8f7e75b25ab6457e2d7') +source=("https://download.kde.org/stable/frameworks/${pkgver%.*}/$pkgname-$pkgver.tar.xz"{,.sig}) +sha256sums=('94c0e292a5d57e014aa745be6b59a989118ead1252d56c768f2719b5c6471372' + 'SKIP') validpgpkeys=(53E6B47B45CEA3E0D5B7457758D0EE648A48B3BB) # David Faure <faure@kde.org> prepare() { mkdir -p build - - # https://phabricator.kde.org/D22979 - patch -Np1 -d $pkgname-$pkgver < 0001-Security-remove-support-for-.-in-config-keys-with-e-.patch } build() { @@ -35,7 +30,7 @@ build() { -DCMAKE_INSTALL_LIBEXECDIR=lib \ -DBUILD_TESTING=OFF \ -DBUILD_QCH=ON - make + make -j1 } package() {