https://bugs.kde.org/show_bug.cgi?id=527863
Tomáš Hnyk <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |[email protected] --- Comment #1 from Tomáš Hnyk <[email protected]> --- Hm, I can see how adding a hint to include -- before %s or %0 could be cheap and sensible. All my actions take %s as the last thing. Simple enough could be adding "--" ourselves and allowing the user to opt out of it in case their tool does not support it, but I think a hint might be enough. Klipper does not run on non-unixes, no need to worry about those. The escaping is done here: https://invent.kde.org/frameworks/kcoreaddons/-/blob/master/src/lib/text/kmacroexpander_unix.cpp Is there a problem with that or does not not work with some shell? Otherwise it sounds like a lot of effort for a fairly convoluted threat. A user needs to have a bad action, then they have to select or copy a bad text and run an action on it. Can you come up with a simple example where this threat occurs? Just like what action I would need to have and what I would need to copy and run the action on to let's say create a file on my Desktop saying "p0wned" or something? -- You are receiving this mail because: You are watching all bug changes.
