Package: xdg-utils
Version: 1.1.0~rc1+git20111210-7.1
Followup-For: Bug #758842
Dear maintainer,
xdg-open is broken, and using it for big files effectively makes xdg-open
unusable for generic case (ie. no DE).
There is also **security issue** since xdg-open could be manipulated to run any
executable if `grep -E "^Exec(\[[^]=]*])?=` match on given file. This is
potentionaly very dangerous.
Since the bug is generally name collision I suggest renaming the affected
variable as quick bugfix.
Cheers,
Jiri
System Information:
Debian Release: jessie/sid
APT prefers testing
APT policy: (990, 'testing'), (500, 'testing-updates'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
xdg-utils depends on no packages.
Versions of packages xdg-utils recommends:
pn libfile-mimeinfo-perl <none>
pn libnet-dbus-perl <none>
pn libx11-protocol-perl <none>
ii x11-utils 7.7+2
ii x11-xserver-utils 7.7+3+b1
Versions of packages xdg-utils suggests:
pn gvfs-bin <none>
-- no debconf information
--- /usr/bin/xdg-open.backup 2014-11-30 22:21:55.974306877 +0100
+++ /usr/bin/xdg-open 2014-11-30 22:02:01.972186095 +0100
@@ -537,18 +537,18 @@
DEBUG 3 "$xdg_user_dir:$xdg_system_dirs"
for x in `echo "$xdg_user_dir:$xdg_system_dirs" | sed 's/:/ /g'`; do
- local file
+ local local_file
# look for both vendor-app.desktop, vendor/app.desktop
if [ -r "$x/applications/$default" ]; then
- file="$x/applications/$default"
+ local_file="$x/applications/$default"
elif [ -r "$x/applications/`echo $default | sed -e 's|-|/|'`" ]; then
- file="$x/applications/`echo $default | sed -e 's|-|/|'`"
+ local_file="$x/applications/`echo $default | sed -e 's|-|/|'`"
fi
- if [ -r "$file" ] ; then
- command="`grep -E "^Exec(\[[^]=]*])?=" "$file" | cut -d= -f 2- | first_word`"
+ if [ -r "$local_file" ] ; then
+ command="`grep -E "^Exec(\[[^]=]*])?=" "$local_file" | cut -d= -f 2- | first_word`"
command_exec=`which $command 2>/dev/null`
- arguments="`grep -E "^Exec(\[[^]=]*])?=" "$file" | cut -d= -f 2- | last_word`"
+ arguments="`grep -E "^Exec(\[[^]=]*])?=" "$local_file" | cut -d= -f 2- | last_word`"
local sed_escaped_url="$(echo "$1" | sed -e 's/[&\\]/\\&/g')"
arguments_exec="`echo $arguments | sed -e 's*%[fFuU]*"'"$sed_escaped_url"'"*g'`"
if [ -x "$command_exec" ] ; then
