Ryan Hughes
07443f3970
The click action of a notification was a free-form shell string run through `bash -lc`, safe only when every sender shell-quoted every interpolated value perfectly. One slip is RCE: a hostile yt-dlp video title forged an output record and injected an mpv option into the click command (mehmetince.net RCE, partially addressed by #7847). Add a parameterized transport: omarchy-notification-send gains --exec-arg (repeatable), encoding a JSON argv into the omarchy-exec-argv hint. The shell runs it with Quickshell.execDetached(argv) and no shell, so data an attacker controls is only ever one argument and can never be reparsed as a command. The shell fails closed on a malformed argv hint. The legacy free-form --exec string is retained but honored only from Omarchy's own omarchy-action toasts, and deprecated. Migrate all in-repo callers (screenshot, screen recording, taildrop receive, migrate-notify, crash-watch, yt-dlp host) to --exec-arg. Update docs and tests.
Omarchy
Omarchy is a beautiful, modern & opinionated Linux distribution by DHH.
Read more at omarchy.org.
The Omarchy Manual
The manual lives in manual/, which is its authoritative source. It's
mirrored to learn.omacom.io, where
its screenshots are also hosted.
The Basics
- Getting Started
- Coming From Mac or Windows
- Navigation
- The top bar
- Themes
- Hotkeys
- Unified Clipboard & History
- Reminders
- Notices
- Text Extraction & Dictation
- Screenshots & Recording
- Toggles, idle & screensaver
- Omarchy CLI
The Applications
- Terminal
- Neovim
- AI
- Development Tools
- Shell Tools
- Shell Functions
- TUIs
- GUIs
- Browsers
- Commercial apps/services
- Web Apps
- Gaming
- Filling out PDFs
- Windows VM
- Other Packages
Configuration
- Updates
- Dotfiles
- Shell plugins
- Monitors
- Keyboard, Mouse, Trackpad
- Networking
- System sleep
- Hardware authentication
- Fonts
- Backgrounds
- Prompt
- Branding
- Common tweaks
- Extra themes
- Making your own theme
The Rest
- Mac support
- Troubleshooting
- FAQ
- System snapshots
- Security
- Omarchy on...
- Dual Boot Install
- Unattended Installs
License
Omarchy is released under the MIT License.