Your message dated Wed, 15 Nov 2017 21:10:37 +0000
with message-id <e1ef4xb-000iys...@fasolo.debian.org>
and subject line Bug#289745: fixed in sensible-utils 0.0.11
has caused the Debian Bug report #289745,
regarding debianutils: sensible-browser incorrectly handles BROWSER
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
289745: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=289745
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: debianutils
Version: 2.11.2
sensible-browser does not appear to handle the BROWSER variable
correctly :-(
For example, with Eric Raymond's example:
BROWSER='mozilla -raise -remote "openURL(%s,new-window)":links'
because the command will be split and not handed to /bin/sh, mozilla
will receive the arguments (C syntax):
argv[0] = "-raise"
argv[1] = "-remote"
argv[2] = "\"openURL(http://www.blah.org/,new-window)\""
argv[3] = NULL
Unfortunately, the embedded quotes in argv[2] cause mozilla to fail.
My suggested solution to this is to replace sensible-browser with an
appropriate modification of David Wheeler's browse script, along with
his "Secure BROWSER" modification of Eric Raymond's BROWSER variable,
all available from http://www.dwheeler.com/browse/, with BROWSE under
a DFSG license, but the specs not yet.
Julian
--- End Message ---
--- Begin Message ---
Source: sensible-utils
Source-Version: 0.0.11
We believe that the bug you reported is fixed in the latest version of
sensible-utils, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 289...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bastien Roucariès <ro...@debian.org> (supplier of updated sensible-utils
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 15 Nov 2017 16:30:02 +0100
Source: sensible-utils
Binary: sensible-utils
Architecture: source
Version: 0.0.11
Distribution: unstable
Urgency: high
Maintainer: Anibal Monsalve Salazar <ani...@debian.org>
Changed-By: Bastien Roucariès <ro...@debian.org>
Description:
sensible-utils - Utilities for sensible alternative selection
Closes: 289745 881767
Changes:
sensible-utils (0.0.11) unstable; urgency=high
.
* Bug fix: "Argument injection in sensible-browser", thanks to Gabriel
Corona (Closes: #881767). Fixing this bug by not supporting %s
expansion in $BROWSER. Users needing this feature (like running
'firefox -remote "openURL(%s,new-window)"', with %s the URL)
could use a shell wrapper. Remove also multiple browser support.
* Fixing #881767 means not using unsupportable %s in $BROWSER, thus
Closes: #289745.
Checksums-Sha1:
c072b9cd1ea5520027c33e9049d91f3e2379ccd3 1671 sensible-utils_0.0.11.dsc
fe6ceb0ddc2b6ca3b7f360d52f9dbbc3cb531302 61448 sensible-utils_0.0.11.tar.xz
d5a2091f5e972c6664ac3e9e773db40f133c8813 4278
sensible-utils_0.0.11_source.buildinfo
Checksums-Sha256:
00bd8cde4229752593ee06f562f8cd8d91ed3a138b2339417ccd6539e542a5c5 1671
sensible-utils_0.0.11.dsc
f1702bc0c129cfe18fb9ae8c0c7b7aedb5b2e6c0467ab3e1da18a8bbb21fe131 61448
sensible-utils_0.0.11.tar.xz
d301ec9efd77b6e1ae90aa8d92b95712973a64f49eaceab2684d227ec8ccacd1 4278
sensible-utils_0.0.11_source.buildinfo
Files:
7dd672249b9be164ea6a5280c95f50aa 1671 utils required sensible-utils_0.0.11.dsc
43e55555f68935e5a9cd9bd5961f72c2 61448 utils required
sensible-utils_0.0.11.tar.xz
9f06f3e0428cd28ea8afd2a69903f72f 4278 utils required
sensible-utils_0.0.11_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAloMpyIACgkQADoaLapB
CF+0jQ//f2Yky+u0OUoi+3yOG5WmwZFwyGnlyqX38sQiP8nO2+qOYKrh5EY/pjLT
I0N6YSrRoldyAu4zFuC6WKGxmq7bxNlrhsgfCs8l1H2R/aqXeIuMfiL7tF90xW1l
lt9CMYzNClaMXmBVaU/E1JJ9Ei4+qmn8HEnDawfER3WX6aiIdNtvnXzAqG1PrGkT
Tvi5sxnbLXP6cMsx4RsvdAEmzJ9eVwivt8dxIugel3tBFK9dibm/I8HqLcDvDHVQ
sU1iHTwuqsNckkQDzE61YFbnOQ0abcVeeVg+5zqGv2mfgY0vFPb0P7eamarV0rpN
HUQMJyu2xZgcUzg3cUBUfzrBYc/Ien4DjHbKRhMe1pM063wyoimhjfVvk7LmL/pW
esUQTdvIU3yE1KVbs07fuysT/7V2CW8Bd37G18sPZEFxrXnURiSvTvxuiGRESdFr
mE8fB3aD65ZVLmMOCQwIpWNxE2FTOKuhiN48MBPZIxzxfena9lgJzv23eDk2bMrK
x5GFODcVwAc5hBDOTuZbgp91n1U8U7XzPLxgjG5dXgS00LMndb+8EC9061geMReQ
kyIYMPGLvfzP4T5JsT/emBGktcpxqMCO0m4drfvR1ABAdD/88RpNFr4hp3cgwr3H
gHUaSe8WP8JGKYw9BwC4dkDgvkZXg6t2dnp+JvHQpeHyqzqOfHY=
=mbfr
-----END PGP SIGNATURE-----
--- End Message ---