ZacharyZhang-NY/omarchycn
3
4
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases 5 Wiki Activity

Remove --exec entirely; --exec-arg is the only click-command form

Browse Source 
A free-form shell-string --exec sitting next to the safe --exec-arg is a
standing invitation for the next caller to interpolate untrusted data and
reintroduce the RCE. Remove it: omarchy-notification-send --exec now errors and
points at --exec-arg, and the shell drops the omarchy-exec string hint and its
bash -lc execution path, leaving only the argv path.

Migrate the remaining string callers (the first-run invitation hooks, wifi and
welcome prompts) to --exec-arg, and update their notification mocks. Trim the
verbose security comments added along the way.
This commit is contained in:
Ryan Hughes
2026-08-23 13:35:02 -04:00
parent d2fd2e11c6
commit eb988b42e6
17 changed files with 97 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/shell.d/notifications-test.sh
+13 -18
View File
@@ -385,36 +385,31 @@ assertEqual(
'notifications omit the deadline field until a restore sets it'
)
// A click action carried as a command is the only kind that survives a shell
// The click action (an argv vector) is the only kind that survives a shell
// restart: a libnotify action leaves its sender waiting on an id from a server
// generation that no longer exists.
assertEqual(
notifications.snapshotOf({ id: 3, hints: { 'omarchy-exec': 'omarchy-menu-keybindings' } }, 1).exec,
'omarchy-menu-keybindings',
'notifications capture the click command from the exec hint'
)
assertEqual(
notifications.snapshotOf({ id: 3, hints: { 'omarchy-glyph': '!' } }, 1).exec,
notifications.snapshotOf({ id: 3, hints: { 'omarchy-glyph': '!' } }, 1).execArgv,
'',
'notifications leave the click command empty without an exec hint'
'notifications leave the click command empty without an exec argv hint'
)
assertEqual(
notifications.popupEntry(
JSON.parse(notifications.serializePopup({ id: 1, originalId: 1, timestamp: 5, exec: "mpv '/tmp/a b.mp4'" }, 1)),
JSON.parse(notifications.serializePopup({ id: 1, originalId: 1, timestamp: 5, execArgv: '["mpv","--","/tmp/a b.mp4"]' }, 1)),
1
).exec,
"mpv '/tmp/a b.mp4'",
'notifications round-trip the click command through popup files'
).execArgv,
'["mpv","--","/tmp/a b.mp4"]',
'notifications round-trip the click argv through popup files'
)
assertEqual(
notifications.popupEntry({ id: 1, originalId: 1, timestamp: 5 }, 1).exec,
notifications.popupEntry({ id: 1, originalId: 1, timestamp: 5 }, 1).execArgv,
'',
'notifications restore an empty click command for popups without one'
)
assertEqual(
notifications.historyEntry({ id: 1, exec: 'xdg-open /tmp/received' }, 1).exec,
'xdg-open /tmp/received',
'notifications keep the click command on history rows'
notifications.historyEntry({ id: 1, execArgv: '["xdg-open","/tmp/received"]' }, 1).execArgv,
'["xdg-open","/tmp/received"]',
'notifications keep the click argv on history rows'
)
const serviceQml = fs.readFileSync(path.join(root, 'shell/plugins/notifications/Service.qml'), 'utf8')
@@ -559,8 +554,8 @@ assert(
'notifications service delimits every popup file during restore'
)
assert(
/var command = entry \? String\(entry\.exec \|\| ""\) : ""[\s\S]{0,300}?Util\.execDetached\(command\)/.test(serviceQml),
'notifications service runs the popup click command itself instead of a libnotify action'
/parseExecArgv\(entry \? entry\.execArgv : ""\)[\s\S]{0,200}?Util\.execArgv\(argv\)/.test(serviceQml),
'notifications service runs the popup click argv itself instead of a libnotify action'
)
assert(
/function clear\(\): string \{\s*service\.clearHistory\(\)/.test(serviceQml),