Skip to content

Commit cf2fe93

Browse files
committed
fix: remove bash -c for security hardening
1. Replaced bash -c command execution with direct process execution for improved security 2. Changed from using bash shell to directly execute setxkbmap command 3. Implemented manual parsing of setxkbmap output instead of relying on grep and awk through bash 4. Added proper handling of output format including colon removal when present Log: Improved security by removing bash -c command execution Influence: 1. Test lock screen functionality still works correctly 2. Verify keyboard options are properly retrieved and restored 3. Test with different keyboard configurations to ensure parsing works correctly 4. Verify no regression in lock screen behavior 5. Test security by attempting command injection (should now be prevented) 6. Verify process execution works without bash shell dependencies fix: 移除 bash -c 以提高安全性 1. 将 bash -c 命令执行替换为直接进程执行以提高安全性 2. 从使用 bash shell 改为直接执行 setxkbmap 命令 3. 实现了手动解析 setxkbmap 输出,而不是通过 bash 依赖 grep 和 awk 4. 添加了适当的输出格式处理,包括存在冒号时的移除处理 Log: 通过移除 bash -c 命令执行提高了安全性 Influence: 1. 测试锁屏功能是否仍然正常工作 2. 验证键盘选项是否正确获取和恢复 3. 使用不同的键盘配置测试以确保解析正常工作 4. 验证锁屏行为没有回归问题 5. 测试安全性,尝试命令注入(现在应该被阻止) 6. 验证进程执行在没有 bash shell 依赖的情况下正常工作
1 parent a30e646 commit cf2fe93

File tree

1 file changed

+19
-2
lines changed

1 file changed

+19
-2
lines changed

applets/dde-shutdown/shutdownapplet.cpp

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,9 +82,26 @@ void ShutdownApplet::x11LockScreen()
8282
QString originMap;
8383

8484
// Step 1: get current keyboard options
85-
process.start("bash", {"-c", "/usr/bin/setxkbmap -query | grep option | awk -F ' ' '{print $2}'"});
85+
process.start("/usr/bin/setxkbmap", QStringList() << "-query");
8686
process.waitForFinished();
87-
originMap = QString::fromUtf8(process.readAllStandardOutput()).trimmed();
87+
QString output = QString::fromUtf8(process.readAllStandardOutput());
88+
QStringList lines = output.split('\n');
89+
for (const QString &line : lines) {
90+
// 查找包含 "option" 的行(原 grep option 命令)
91+
if (line.contains("option")) {
92+
// 模拟 awk -F ' ' '{print $2}'
93+
// 按空格分割,跳过空字符串
94+
QStringList parts = line.split(' ', Qt::SkipEmptyParts);
95+
if (parts.size() >= 2) {
96+
originMap = parts[1];
97+
// 如果第二个字段以冒号结尾,可能需要进一步处理
98+
if (originMap.endsWith(':')) {
99+
originMap = originMap.left(originMap.length() - 1);
100+
}
101+
}
102+
break;
103+
}
104+
}
88105

89106
// Step 2: set keyboard options to un grab
90107
process.start("/usr/bin/setxkbmap", {"-option", "grab:break_actions"});

0 commit comments

Comments
 (0)