Package: xfe
Version: 1.42-1+b1
Severity: important
Tags: patch
Dear Maintainer,
when the packages query is performed on a file belonging to a multi-arch
package xfe will falsely report that the file does not belong to any package. I
believe this is an important bug, since it might lead unsuspecting users to
delete important system files from their disk, because they think they do not
belong to any installed package and thus are safe to remove.
The bug is caused by the way xfe handles the output string of dpkg -S. It
currently uses the first colon in the string as "field separator", which fails
when the package name is something like "libfoo:amd64". It will also fail when
the file name includes a colon. To verify the latter I looked for files
installed by any package including a colon in their names and found only a
large number of perl-related manpage files in .gz format. I only noticed then
that for no obvious reason the packages query was disabled for archive files.
To verify that the packages query also fails with files including a colon in
their names I (at first temporarily) enabled the packages query also for
archive files. Since I believe that the packages query should be possible for
these manpage files I decided to keep this change then intact in the patch (I
apologize in advance if this was a bad decision).
The patch I wrote now uses the first whitespace character in the dpkg output as
separator instead of the colon. I also modified the algorithm so that it will
work no matter what the file and package names look like. Since package names
may not include space characters I believe this approach should be safe in any
case.
In case you don't want to enable the packages query for archive files (which I
could understand) please just remove that section from the patch (it is only
one line I changed from "if ((num == 1) && !ar)" into "if (num == 1)").
For the reason explained above I think the bug causing the false negatives
should be fixed asap though, probably even in Stable.
Best regards
Michael
-- System Information:
Debian Release: 9.2
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'proposed-updates'), (500,
'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 4.12.0-0.bpo.2-amd64 (SMP w/2 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8),
LANGUAGE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages xfe depends on:
ii libc6 2.24-11+deb9u1
ii libfontconfig1 2.11.0-6.7+b1
ii libfox-1.6-0 1.6.53-1
ii libfreetype6 2.6.3-3.2
ii libgcc1 1:6.3.0-18
ii libpng16-16 1.6.28-1
ii libstdc++6 6.3.0-18
ii libx11-6 2:1.6.4-3
ii libxft2 2.3.2-1+b2
ii xfe-themes 1.42-1
Versions of packages xfe recommends:
ii audacious 1:3.8.2-dmo1
ii xarchiver 1:0.5.4-7
ii xfe-i18n 1.42-1
ii xterm 327-2
Versions of packages xfe suggests:
ii evince 3.22.1-3+deb9u1
pn meld | diffuse | fldiff <none>
ii rpm 4.12.0.2+dfsg1-2
pn xine-ui <none>
ii xpdf 3.04-4
diff -ur /usr/src/xfe/1.42/xfe-1.42_orig/src/FilePanel.cpp
/usr/src/xfe/1.42/xfe-1.42/src/FilePanel.cpp
--- /usr/src/xfe/1.42/xfe-1.42_orig/src/FilePanel.cpp 2016-07-27
11:48:17.000000000 +0200
+++ /usr/src/xfe/1.42/xfe-1.42/src/FilePanel.cpp 2017-10-24
00:07:28.603964809 +0200
@@ -4535,7 +4535,7 @@
new FXMenuCommand(menu, _("&Add to archive..."), archaddicon,
current, FilePanel::ID_ADD_TO_ARCH);
}
#if defined(linux)
- if ((num == 1) && !ar)
+ if (num == 1)
{
new FXMenuCommand(menu, _("Packages &query "), packageicon,
current, FilePanel::ID_PKG_QUERY);
}
@@ -5944,10 +5944,13 @@
FXString str = text;
if (pkg_format == DEB_PKG) // DEB based distribution
{
- FXString substr = str.section(':', 1);
- if (substr.length()-2 == file.length()) // No other word than the file
name
+ int idx = str.find(" "); // split output at first whitespace
+ FXString pkgname = str.left(idx-1); // remove trailing colon
+ FXString fname = str.right(str.length()-idx);
+ fname.trim(); // remove leading space and trailing newline
+ if (streq(fname.text(), file.text())) // No other word than the file
name
{
- str = str.section(':', 0); // (plus ' ' at the beginning
and '\n' at the end)
+ str = pkgname.text();
}
else
{
diff -ur /usr/src/xfe/1.42/xfe-1.42_orig/src/SearchPanel.cpp
/usr/src/xfe/1.42/xfe-1.42/src/SearchPanel.cpp
--- /usr/src/xfe/1.42/xfe-1.42_orig/src/SearchPanel.cpp 2016-07-27
11:46:58.000000000 +0200
+++ /usr/src/xfe/1.42/xfe-1.42/src/SearchPanel.cpp 2017-10-24
00:08:20.902137622 +0200
@@ -2307,7 +2307,7 @@
new FXMenuCommand(menu, _("&Add to archive..."), archaddicon,
this, SearchPanel::ID_ADD_TO_ARCH);
}
#if defined(linux)
- if ((num == 1) && !ar)
+ if (num == 1)
{
new FXMenuCommand(menu, _("&Packages query "), packageicon, this,
SearchPanel::ID_PKG_QUERY);
}
@@ -4361,10 +4361,13 @@
FXString str = text;
if (pkg_format == DEB_PKG) // DEB based distribution
{
- FXString substr = str.section(':', 1);
- if (substr.length()-2 == file.length()) // No other word than the file
name
+ int idx = str.find(" "); // split output at first whitespace
+ FXString pkgname = str.left(idx-1); // remove trailing colon
+ FXString fname = str.right(str.length()-idx);
+ fname.trim(); // remove leading space and trailing newline
+ if (streq(fname.text(), file.text())) // No other word than the file
name
{
- str = str.section(':', 0); // (plus ' ' at the beginning
and '\n' at the end)
+ str = pkgname.text();
}
else
{
diff -ur /usr/src/xfe/1.42/xfe-1.42_orig/src/FilePanel.cpp
/usr/src/xfe/1.42/xfe-1.42/src/FilePanel.cpp
--- /usr/src/xfe/1.42/xfe-1.42_orig/src/FilePanel.cpp 2016-07-27
11:48:17.000000000 +0200
+++ /usr/src/xfe/1.42/xfe-1.42/src/FilePanel.cpp 2017-10-24
00:07:28.603964809 +0200
@@ -4535,7 +4535,7 @@
new FXMenuCommand(menu, _("&Add to archive..."), archaddicon,
current, FilePanel::ID_ADD_TO_ARCH);
}
#if defined(linux)
- if ((num == 1) && !ar)
+ if (num == 1)
{
new FXMenuCommand(menu, _("Packages &query "), packageicon,
current, FilePanel::ID_PKG_QUERY);
}
@@ -5944,10 +5944,13 @@
FXString str = text;
if (pkg_format == DEB_PKG) // DEB based distribution
{
- FXString substr = str.section(':', 1);
- if (substr.length()-2 == file.length()) // No other word than the file
name
+ int idx = str.find(" "); // split output at first whitespace
+ FXString pkgname = str.left(idx-1); // remove trailing colon
+ FXString fname = str.right(str.length()-idx);
+ fname.trim(); // remove leading space and trailing newline
+ if (streq(fname.text(), file.text())) // No other word than the file
name
{
- str = str.section(':', 0); // (plus ' ' at the beginning
and '\n' at the end)
+ str = pkgname.text();
}
else
{
diff -ur /usr/src/xfe/1.42/xfe-1.42_orig/src/SearchPanel.cpp
/usr/src/xfe/1.42/xfe-1.42/src/SearchPanel.cpp
--- /usr/src/xfe/1.42/xfe-1.42_orig/src/SearchPanel.cpp 2016-07-27
11:46:58.000000000 +0200
+++ /usr/src/xfe/1.42/xfe-1.42/src/SearchPanel.cpp 2017-10-24
00:08:20.902137622 +0200
@@ -2307,7 +2307,7 @@
new FXMenuCommand(menu, _("&Add to archive..."), archaddicon,
this, SearchPanel::ID_ADD_TO_ARCH);
}
#if defined(linux)
- if ((num == 1) && !ar)
+ if (num == 1)
{
new FXMenuCommand(menu, _("&Packages query "), packageicon, this,
SearchPanel::ID_PKG_QUERY);
}
@@ -4361,10 +4361,13 @@
FXString str = text;
if (pkg_format == DEB_PKG) // DEB based distribution
{
- FXString substr = str.section(':', 1);
- if (substr.length()-2 == file.length()) // No other word than the file
name
+ int idx = str.find(" "); // split output at first whitespace
+ FXString pkgname = str.left(idx-1); // remove trailing colon
+ FXString fname = str.right(str.length()-idx);
+ fname.trim(); // remove leading space and trailing newline
+ if (streq(fname.text(), file.text())) // No other word than the file
name
{
- str = str.section(':', 0); // (plus ' ' at the beginning
and '\n' at the end)
+ str = pkgname.text();
}
else
{
