https://bugs.kde.org/show_bug.cgi?id=527863
--- Comment #2 from Paul Wise <[email protected]> --- I definitely would not automatically add -- but a hint sounds like a good idea. While researching this issue, I found a (vibecoded) port of Plasma Workspace to Windows, so in theory Klipper could run on Windows :) https://github.com/ChPu437/plasma-windows I view this shell issue the same as I would SQL injection; while you can mitigate the vulnerabilities by manually escaping everything and hoping you got it right, and hoping the implementation recieving the escaped strings interprets things correctly, it is better to switch to an interface that has a better design that prevents all issues. For SQL that would be parameterised queries, for QProcess that would be stringlists. I'm not an experienced security researcher so I probably could not find any issues, am asking others to take a look. I note the code is already having to handle ash vs bash differences. I agree with you that in practice, right now the shell meta-character escaping is probably good enough. I agree with you that it would require significant effort for currently little reward. Any new UI for this could be made into a reusable component that other code from the KDE community could use when configuring commands to run, or maybe one exists already? PS: here is a satirical post I wrote about shell meta-character injection some years ago. https://bonedaddy.net/pabs3/log/2014/02/17/pid-preservation-society/ -- You are receiving this mail because: You are watching all bug changes.
