From be63983d16ec2673f5f6e0f4bfc7167b8344d807 Mon Sep 17 00:00:00 2001 From: Ryan Hughes Date: Sun, 23 Aug 2026 16:47:13 -0400 Subject: [PATCH] Describe parseExecArgv as a structural check, not intent MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The comment claimed the validation kept a hostile hint from reaching a shell, but it is purely structural: a well-formed ["bash","-c",…] passes. Say so, and point at the separate sender-trust boundary. --- shell/plugins/notifications/NotificationLogic.js | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/shell/plugins/notifications/NotificationLogic.js b/shell/plugins/notifications/NotificationLogic.js index 849521c2..9bad602d 100644 --- a/shell/plugins/notifications/NotificationLogic.js +++ b/shell/plugins/notifications/NotificationLogic.js @@ -66,9 +66,13 @@ function execArgvFromHints(hints) { return stringHint(hints, "omarchy-exec-argv") } -// Validate a persisted omarchy-exec-argv into a runnable argv, or null. Fails -// closed so a malformed/hostile hint never reaches a shell: must be a non-empty -// JSON array of strings whose program is present and not a leading-dash option. +// Validate a persisted omarchy-exec-argv into a runnable argv, or null. This is +// a STRUCTURAL check only: it fails closed on a malformed hint (non-array, a +// non-string or empty program, or a leading-dash program that argv would read as +// an option). It does not judge intent — a well-formed ["bash","-c",…] is +// accepted. WHICH senders may set this hint is a separate boundary: any +// session-bus process can, by the freedesktop protocol's design (see +// docs/notifications.md), which is equivalent to same-uid code execution. function parseExecArgv(value) { var text = String(value || "") if (!text) return null