https://bugs.kde.org/show_bug.cgi?id=524243
Bug ID: 524243
Summary: Folder View at a file:// URL labels .desktop files by
filename, not Name=
Classification: Plasma
Product: plasmashell
Version First 6.6.6
Reported In:
Platform: Kubuntu
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: Folder View widget
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected]
Target Milestone: 1.0
Product: plasmashell · Component: Folder View widget · Severity: normal
SUMMARY
A Folder View widget pointed at a plain file:// directory containing .desktop
files renders each entry's filename (org.kicad.pcbnew.desktop) rather than its
Name= field (PCB Editor). The same files shown through desktop:/ are labelled
correctly.
STEPS TO REPRODUCE
1. mkdir ~/Desktop/Apps, copy several launchers into it —
org.kicad.pcbnew.desktop makes the mismatch obvious since the filename and the
display name share nothing.
2. Add a Folder View widget, set its location to
file:///home/$USER/Desktop/Apps.
3. Compare against a Folder View pointed at desktop:/Apps.
OBSERVED RESULT
file:// shows org.kicad.pcbnew.desktop. desktop:/ shows PCB Editor.
EXPECTED RESULT
Consistent labelling between the two URL schemes.
ADDITIONAL INFORMATION
This may be intentional — withholding Name= from untrusted .desktop files is a
recognised anti-spoofing measure, and if so this should be closed as NOTABUG.
One observation that argues against that reading: the icon from the same
.desktop file resolves and renders correctly. A trust boundary that displays
the attacker-controlled icon while suppressing the attacker-controlled name is
not obviously protecting anything, so if this is deliberate the inconsistency
may still be worth a look.
--
You are receiving this mail because:
You are watching all bug changes.
