1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
|
xdg-email does not parse mailto uris properly for thunderbird
When using thunderbird as mailto handler xdg-email translates mailto uris into an 'thunderbird -compose' argument. While to, cc and bcc values are properly enclosed in single quotes this is not the case for subject or body. This breaks functionality and allows to use all thunderbird -compose arguments within a mailto uri, e.g.
xdg-email 'mailto:test@example.com?subject=Test,attachment=~/.thunderbird/profiles.ini,message=/home/test/test.txt'
translates into
thunderbird -compose to='test@example.com,',subject=Test,attachment=~/.thunderbird/profiles.ini,message=/home/test/test.txt
with working attachment and message. (And, yes, ~ expands to the home directory.)
Upstream-Status: Submitted [https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/205]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
CVE: CVE-2022-4055
Index: xdg-utils-1.1.3/scripts/xdg-email.in
===================================================================
--- xdg-utils-1.1.3.orig/scripts/xdg-email.in
+++ xdg-utils-1.1.3/scripts/xdg-email.in
@@ -30,53 +30,6 @@ _USAGE
#@xdg-utils-common@
-run_thunderbird()
-{
- local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY
- THUNDERBIRD="$1"
- MAILTO=$(echo "$2" | sed 's/^mailto://')
- echo "$MAILTO" | grep -qs "^?"
- if [ "$?" = "0" ] ; then
- MAILTO=$(echo "$MAILTO" | sed 's/^?//')
- else
- MAILTO=$(echo "$MAILTO" | sed 's/^/to=/' | sed 's/?/\&/')
- fi
-
- MAILTO=$(echo "$MAILTO" | sed 's/&/\n/g')
- TO=$(/bin/echo -e $(echo "$MAILTO" | grep '^to=' | sed 's/^to=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }'))
- CC=$(/bin/echo -e $(echo "$MAILTO" | grep '^cc=' | sed 's/^cc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }'))
- BCC=$(/bin/echo -e $(echo "$MAILTO" | grep '^bcc=' | sed 's/^bcc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }'))
- SUBJECT=$(echo "$MAILTO" | grep '^subject=' | tail -n 1)
- BODY=$(echo "$MAILTO" | grep '^body=' | tail -n 1)
-
- if [ -z "$TO" ] ; then
- NEWMAILTO=
- else
- NEWMAILTO="to='$TO'"
- fi
- if [ -n "$CC" ] ; then
- NEWMAILTO="${NEWMAILTO},cc='$CC'"
- fi
- if [ -n "$BCC" ] ; then
- NEWMAILTO="${NEWMAILTO},bcc='$BCC'"
- fi
- if [ -n "$SUBJECT" ] ; then
- NEWMAILTO="${NEWMAILTO},$SUBJECT"
- fi
- if [ -n "$BODY" ] ; then
- NEWMAILTO="${NEWMAILTO},$BODY"
- fi
-
- NEWMAILTO=$(echo "$NEWMAILTO" | sed 's/^,//')
- DEBUG 1 "Running $THUNDERBIRD -compose \"$NEWMAILTO\""
- "$THUNDERBIRD" -compose "$NEWMAILTO"
- if [ $? -eq 0 ]; then
- exit_success
- else
- exit_failure_operation_failed
- fi
-}
-
open_kde()
{
if [ -n "$KDE_SESSION_VERSION" ] && [ "$KDE_SESSION_VERSION" -ge 5 ]; then
@@ -130,15 +83,6 @@ open_kde()
open_gnome3()
{
- local client
- local desktop
- desktop=`xdg-mime query default "x-scheme-handler/mailto"`
- client=`desktop_file_to_binary "$desktop"`
- echo $client | grep -E 'thunderbird|icedove' > /dev/null 2>&1
- if [ $? -eq 0 ] ; then
- run_thunderbird "$client" "$1"
- fi
-
if gio help open 2>/dev/null 1>&2; then
DEBUG 1 "Running gio open \"$1\""
gio open "$1"
@@ -159,13 +103,6 @@ open_gnome3()
open_gnome()
{
- local client
- client=`gconftool-2 --get /desktop/gnome/url-handlers/mailto/command | cut -d ' ' -f 1` || ""
- echo $client | grep -E 'thunderbird|icedove' > /dev/null 2>&1
- if [ $? -eq 0 ] ; then
- run_thunderbird "$client" "$1"
- fi
-
if gio help open 2>/dev/null 1>&2; then
DEBUG 1 "Running gio open \"$1\""
gio open "$1"
@@ -231,15 +168,6 @@ open_flatpak()
open_generic()
{
- local client
- local desktop
- desktop=`xdg-mime query default "x-scheme-handler/mailto"`
- client=`desktop_file_to_binary "$desktop"`
- echo $client | grep -E 'thunderbird|icedove' > /dev/null 2>&1
- if [ $? -eq 0 ] ; then
- run_thunderbird "$client" "$1"
- fi
-
xdg-open "$1"
local ret=$?
@@ -364,21 +292,6 @@ while [ $# -gt 0 ] ; do
shift
;;
- --attach)
- if [ -z "$1" ] ; then
- exit_failure_syntax "file argument missing for --attach option"
- fi
- check_input_file "$1"
- file=`readlink -f "$1"` # Normalize path
- if [ -z "$file" ] || [ ! -f "$file" ] ; then
- exit_failure_file_missing "file '$1' does not exist"
- fi
-
- url_encode "$file"
- options="${options}attach=${result}&"
- shift
- ;;
-
-*)
exit_failure_syntax "unexpected option '$parm'"
;;
|
