[arch-commits] Commit in kconfig/repos/extra-x86_64 (3 files)

Evangelos Foutras foutrelis at archlinux.org
Wed Aug 7 18:05:15 UTC 2019


    Date: Wednesday, August 7, 2019 @ 18:05:14
  Author: foutrelis
Revision: 359297

archrelease: copy trunk to extra-x86_64

Added:
  kconfig/repos/extra-x86_64/0001-Security-remove-support-for-.-in-config-keys-with-e-.patch
    (from rev 359296, kconfig/trunk/0001-Security-remove-support-for-.-in-config-keys-with-e-.patch)
  kconfig/repos/extra-x86_64/PKGBUILD
    (from rev 359296, kconfig/trunk/PKGBUILD)
Deleted:
  kconfig/repos/extra-x86_64/PKGBUILD

-----------------------------------------------------------------+
 0001-Security-remove-support-for-.-in-config-keys-with-e-.patch |  145 ++++++++++
 PKGBUILD                                                        |   83 +++--
 2 files changed, 189 insertions(+), 39 deletions(-)

Copied: kconfig/repos/extra-x86_64/0001-Security-remove-support-for-.-in-config-keys-with-e-.patch (from rev 359296, kconfig/trunk/0001-Security-remove-support-for-.-in-config-keys-with-e-.patch)
===================================================================
--- 0001-Security-remove-support-for-.-in-config-keys-with-e-.patch	                        (rev 0)
+++ 0001-Security-remove-support-for-.-in-config-keys-with-e-.patch	2019-08-07 18:05:14 UTC (rev 359297)
@@ -0,0 +1,145 @@
+From 5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22 Mon Sep 17 00:00:00 2001
+From: David Faure <faure at kde.org>
+Date: Wed, 7 Aug 2019 09:35:36 +0200
+Subject: [PATCH] Security: remove support for $(...) in config keys with [$e]
+ marker.
+
+Summary:
+It is very unclear at this point what a valid use case for this feature
+would possibly be. The old documentation only mentions $(hostname) as
+an example, which can be done with $HOSTNAME instead.
+
+Note that $(...) is still supported in Exec lines of desktop files,
+this does not require [$e] anyway (and actually works better without it,
+otherwise the $ signs need to be doubled to obey kconfig $e escaping rules...).
+
+Test Plan:
+ctest passes; various testcases with $(...) in desktop files,
+directory files, and config files, no longer execute commands.
+
+Reviewers: mdawson, aacid, broulik, davidedmundson, kossebau, apol, sitter, security-team
+
+Reviewed By: mdawson, davidedmundson
+
+Subscribers: ZaWertun, rikmills, fvogt, ngraham, kde-frameworks-devel
+
+Tags: #frameworks
+
+Differential Revision: https://phabricator.kde.org/D22979
+---
+ autotests/kconfigtest.cpp | 10 ++--------
+ docs/options.md           | 11 ++++-------
+ src/core/kconfig.cpp      | 37 +------------------------------------
+ 3 files changed, 7 insertions(+), 51 deletions(-)
+
+diff --git a/autotests/kconfigtest.cpp b/autotests/kconfigtest.cpp
+index 410b5b8..9af3b46 100644
+--- a/autotests/kconfigtest.cpp
++++ b/autotests/kconfigtest.cpp
+@@ -38,7 +38,7 @@
+ #include <utime.h>
+ #endif
+ #ifndef Q_OS_WIN
+-#include <unistd.h> // gethostname
++#include <unistd.h> // getuid
+ #endif
+ 
+ KCONFIGGROUP_DECLARE_ENUM_QOBJECT(KConfigTest, Testing)
+@@ -546,14 +546,8 @@ void KConfigTest::testPath()
+     QCOMPARE(group.readPathEntry("withBraces", QString()), QString("file://" + HOMEPATH));
+     QVERIFY(group.hasKey("URL"));
+     QCOMPARE(group.readEntry("URL", QString()), QString("file://" + HOMEPATH));
+-#if !defined(Q_OS_WIN32) && !defined(Q_OS_MAC)
+-    // I don't know if this will work on windows
+-    // This test hangs on OS X
+     QVERIFY(group.hasKey("hostname"));
+-    char hostname[256];
+-    QVERIFY(::gethostname(hostname, sizeof(hostname)) == 0);
+-    QCOMPARE(group.readEntry("hostname", QString()), QString::fromLatin1(hostname));
+-#endif
++    QCOMPARE(group.readEntry("hostname", QString()), QStringLiteral("(hostname)")); // the $ got removed because empty var name
+     QVERIFY(group.hasKey("noeol"));
+     QCOMPARE(group.readEntry("noeol", QString()), QString("foo"));
+ 
+diff --git a/docs/options.md b/docs/options.md
+index c634c00..4a6e9bc 100644
+--- a/docs/options.md
++++ b/docs/options.md
+@@ -67,18 +67,15 @@ environment variables (and `XDG_CONFIG_HOME` in particular).
+ Shell Expansion
+ ---------------
+ 
+-If an entry is marked with `$e`, environment variables and shell commands will
+-be expanded.
++If an entry is marked with `$e`, environment variables will be expanded.
+ 
+     Name[$e]=$USER
+-    Host[$e]=$(hostname)
+ 
+ When the "Name" entry is read `$USER` will be replaced with the value of the
+-`$USER` environment variable, and `$(hostname)` will be replaced with the output
+-of the `hostname` command.
++`$USER` environment variable.
+ 
+-Note that the application will replace `$USER` and `$(hostname)` with their
+-respective expanded values after saving. To prevent this combine the `$e` option
++Note that the application will replace `$USER` with its
++expanded value after saving. To prevent this combine the `$e` option
+ with `$i` (immmutable) option.  For example:
+ 
+     Name[$ei]=$USER
+diff --git a/src/core/kconfig.cpp b/src/core/kconfig.cpp
+index e1b11ed..f6824ce 100644
+--- a/src/core/kconfig.cpp
++++ b/src/core/kconfig.cpp
+@@ -28,19 +28,6 @@
+ #include <cstdlib>
+ #include <fcntl.h>
+ 
+-#ifdef _MSC_VER
+-static inline FILE *popen(const char *cmd, const char *mode)
+-{
+-    return _popen(cmd, mode);
+-}
+-static inline int pclose(FILE *stream)
+-{
+-    return _pclose(stream);
+-}
+-#else
+-#include <unistd.h>
+-#endif
+-
+ #include "kconfigbackend_p.h"
+ #include "kconfiggroup.h"
+ 
+@@ -183,29 +170,7 @@ QString KConfigPrivate::expandString(const QString &value)
+     int nDollarPos = aValue.indexOf(QLatin1Char('$'));
+     while (nDollarPos != -1 && nDollarPos + 1 < aValue.length()) {
+         // there is at least one $
+-        if (aValue[nDollarPos + 1] == QLatin1Char('(')) {
+-            int nEndPos = nDollarPos + 1;
+-            // the next character is not $
+-            while ((nEndPos <= aValue.length()) && (aValue[nEndPos] != QLatin1Char(')'))) {
+-                nEndPos++;
+-            }
+-            nEndPos++;
+-            QString cmd = aValue.mid(nDollarPos + 2, nEndPos - nDollarPos - 3);
+-
+-            QString result;
+-
+-// FIXME: wince does not have pipes
+-#ifndef _WIN32_WCE
+-            FILE *fs = popen(QFile::encodeName(cmd).data(), "r");
+-            if (fs) {
+-                QTextStream ts(fs, QIODevice::ReadOnly);
+-                result = ts.readAll().trimmed();
+-                pclose(fs);
+-            }
+-#endif
+-            aValue.replace(nDollarPos, nEndPos - nDollarPos, result);
+-            nDollarPos += result.length();
+-        } else if (aValue[nDollarPos + 1] != QLatin1Char('$')) {
++        if (aValue[nDollarPos + 1] != QLatin1Char('$')) {
+             int nEndPos = nDollarPos + 1;
+             // the next character is not $
+             QStringRef aVarName;

Deleted: PKGBUILD
===================================================================
--- PKGBUILD	2019-08-07 18:05:10 UTC (rev 359296)
+++ PKGBUILD	2019-08-07 18:05:14 UTC (rev 359297)
@@ -1,39 +0,0 @@
-# Maintainer: Felix Yan <felixonmars at archlinux.org>
-# Maintainer: Antonio Rojas <arojas at archlinux.org>
-# Contributor: Andrea Scarpino <andrea at archlinux.org>
-
-pkgname=kconfig
-pkgver=5.60.0
-pkgrel=1
-pkgdesc='Configuration system'
-arch=(x86_64)
-url='https://community.kde.org/Frameworks'
-license=(LGPL)
-depends=(qt5-base)
-makedepends=(extra-cmake-modules qt5-tools clang python-pyqt5 doxygen sip)
-optdepends=('python-pyqt5: for the Python bindings')
-groups=(kf5)
-source=("https://download.kde.org/stable/frameworks/${pkgver%.*}/$pkgname-$pkgver.tar.xz"{,.sig})
-sha256sums=('541acceead9ca516e3562109e7e94351ce378c234bea968c8dfde78f00559233'
-            'SKIP')
-validpgpkeys=(53E6B47B45CEA3E0D5B7457758D0EE648A48B3BB) # David Faure <faure at kde.org>
-
-prepare() {
-  mkdir -p build
-}
-
-build() {
-  cd build
-  cmake ../$pkgname-$pkgver \
-    -DCMAKE_INSTALL_PREFIX=/usr \
-    -DCMAKE_INSTALL_LIBDIR=lib \
-    -DCMAKE_INSTALL_LIBEXECDIR=lib \
-    -DBUILD_TESTING=OFF \
-    -DBUILD_QCH=ON
-  make
-}
-
-package() {
-  cd build
-  make DESTDIR="$pkgdir" install
-}

Copied: kconfig/repos/extra-x86_64/PKGBUILD (from rev 359296, kconfig/trunk/PKGBUILD)
===================================================================
--- PKGBUILD	                        (rev 0)
+++ PKGBUILD	2019-08-07 18:05:14 UTC (rev 359297)
@@ -0,0 +1,44 @@
+# Maintainer: Felix Yan <felixonmars at archlinux.org>
+# Maintainer: Antonio Rojas <arojas at archlinux.org>
+# Contributor: Andrea Scarpino <andrea at archlinux.org>
+
+pkgname=kconfig
+pkgver=5.60.0
+pkgrel=2
+pkgdesc='Configuration system'
+arch=(x86_64)
+url='https://community.kde.org/Frameworks'
+license=(LGPL)
+depends=(qt5-base)
+makedepends=(extra-cmake-modules qt5-tools clang python-pyqt5 doxygen sip)
+optdepends=('python-pyqt5: for the Python bindings')
+groups=(kf5)
+source=("https://download.kde.org/stable/frameworks/${pkgver%.*}/$pkgname-$pkgver.tar.xz"{,.sig}
+        0001-Security-remove-support-for-.-in-config-keys-with-e-.patch)
+sha256sums=('541acceead9ca516e3562109e7e94351ce378c234bea968c8dfde78f00559233'
+            'SKIP'
+            '1e885acaf3743e461bc958cc2d77ed7ca06280a4277fa8f7e75b25ab6457e2d7')
+validpgpkeys=(53E6B47B45CEA3E0D5B7457758D0EE648A48B3BB) # David Faure <faure at kde.org>
+
+prepare() {
+  mkdir -p build
+
+  # https://phabricator.kde.org/D22979
+  patch -Np1 -d $pkgname-$pkgver < 0001-Security-remove-support-for-.-in-config-keys-with-e-.patch
+}
+
+build() {
+  cd build
+  cmake ../$pkgname-$pkgver \
+    -DCMAKE_INSTALL_PREFIX=/usr \
+    -DCMAKE_INSTALL_LIBDIR=lib \
+    -DCMAKE_INSTALL_LIBEXECDIR=lib \
+    -DBUILD_TESTING=OFF \
+    -DBUILD_QCH=ON
+  make
+}
+
+package() {
+  cd build
+  make DESTDIR="$pkgdir" install
+}


More information about the arch-commits mailing list