https://bugs.kde.org/show_bug.cgi?id=527863
Bug ID: 527863
Summary: [Feature Request] option to execute klipper action
commands without using the shell /bin/sh
Classification: Plasma
Product: plasmashell
Version First 6.7.4
Reported In:
Platform: Debian testing
OS: Linux
Status: REPORTED
Severity: wishlist
Priority: NOR
Component: Clipboard widget & pop-up
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected]
Target Milestone: 1.0
DESCRIPTION
Running commands via shell snippets is fairly dangerous since it is hard to get
right without security vulnerabilities, especially shell meta-character
injection and option injection.
This is especially concerning for clipboard data since websites can send data
to the clipboard, and even with user-selected-and-copied data, what is selected
can be different to what is copied, using CSS to hide the extra data.
The danger of shell snippets is especially true for Klipper actions, since the
shell snippets are modified by klipper before running them, and only the %s/%N
modifications are documented, so it is hard to reason about what the final
command will be before it is executed.
That said, Klipper does currently seem to generate the commands correctly on
Unix platforms by escaping shell meta-characters in the %s data (this isn't
mentioned in the UI though), but which /bin/sh is being used could change the
interpretation of shell characters. Not sure what it does on non-Unix
platforms.
To remove all of that user uncertainty, on Unix platforms, it would be nice to
have the option to run commands without using the shell /bin/sh and instead use
posix_spawn or fork+exec or QProcess with stringlists. Windows CreateProcess
does not allow for this unfortunately.
This would need a UI change to have a list of fields for the program and its
arguments, with each field either being a text input field or a dropdown to
select the full clipboard data or one of the regex groups.
Since QProcess is able to do piping via setStandardOutputProcess, and piping
between commands is a common thing to want to do, the no-shell UI could also
have a list of lists of commands+arguments to enable piping between them. It is
fine if you prefer not to add this, since people can create files for each
action with shell or Python etc scripts doing the piping instead, but that
might be more tedious than a UI for simple stuff. Either way the data model
used for the config for the no-shell command execution should allow for later
addition of piping, in case someone wants to add it later.
Personally I feel that the no-shell command execution and UI should be the
default, with the shell option still available for folks who prefer that.
Personally I feel that the shell option should indicate that the command will
be run using /bin/sh, mention the data will be shell quoted before insertion
and have a warning that shellcheck should be used to ensure the shell command
is safe to run without any vulnerabilities, although it does not necessarily
prevent all issues.
To mitigate option injection vulnerabilities, on Unix platforms, it would be
good to have a warning when a no-shell command does not have -- before
clipboard data or regex group insertion, since most POSIX commands use that to
end options processing (some don't though). There are some commands that don't
accept -- though like printf and echo.
The option injection issue applies to shell commands too but parsing the
command is harder there without false positives, on Unix platforms, just
checking " -- " is present and before "%s" should cover most cases, unless
there is a pipeline with the first command having "--" and later commands
having "%s".
Maybe on non-Unix platforms the action menu popup should be disabled, removed
or have a warning, since it doesn't yet have a way to preview the data before
running an action, and there would be no way to eyeball the data to determine
if it is safe.
Maybe on non-Unix platforms there could always be warnings in the command UI
about shell meta-character injection and about options injection.
USE CASES
* Understanding the commands that are generated before they are executed and
ensuring they are safe
ADDITIONAL INFORMATION
shellcheck: https://github.com/koalaman/shellcheck
option injection:
https://web.archive.org/web/20201111203646if_/https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt
Related discussion:
https://invent.kde.org/plasma/plasma-workspace/-/merge_requests/6584#note_1513938
QProcess piping: https://doc.qt.io/qt-6/qprocess.html#setStandardOutputProcess
--
You are receiving this mail because:
You are watching all bug changes.
