Files
omarchycn/bin
Ryan Hughes 07443f3970 Run notification click actions as argv, not shell strings
The click action of a notification was a free-form shell string run through
`bash -lc`, safe only when every sender shell-quoted every interpolated value
perfectly. One slip is RCE: a hostile yt-dlp video title forged an output
record and injected an mpv option into the click command (mehmetince.net RCE,
partially addressed by #7847).

Add a parameterized transport: omarchy-notification-send gains --exec-arg
(repeatable), encoding a JSON argv into the omarchy-exec-argv hint. The shell
runs it with Quickshell.execDetached(argv) and no shell, so data an attacker
controls is only ever one argument and can never be reparsed as a command. The
shell fails closed on a malformed argv hint.

The legacy free-form --exec string is retained but honored only from Omarchy's
own omarchy-action toasts, and deprecated. Migrate all in-repo callers
(screenshot, screen recording, taildrop receive, migrate-notify, crash-watch,
yt-dlp host) to --exec-arg. Update docs and tests.
2026-08-23 12:00:03 -04:00
..
2026-05-21 15:45:36 +02:00
2026-08-11 13:56:09 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-21 19:30:30 +02:00
2026-05-01 17:40:22 +02:00
2026-05-06 12:58:55 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-21 19:30:30 +02:00
2026-05-25 18:19:06 +02:00
2026-05-01 17:40:22 +02:00
2026-05-20 14:09:09 +02:00
2026-05-20 14:12:06 +02:00
2026-05-19 20:54:20 +02:00
2026-05-19 20:54:20 +02:00
2026-05-14 12:02:53 +02:00
2026-05-14 12:02:53 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-06-04 18:37:32 -04:00
2026-05-04 11:18:25 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-05-05 14:22:03 +02:00
2026-05-01 17:40:22 +02:00
2026-08-08 02:31:23 -07:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00
2026-06-04 11:14:04 +02:00
2026-06-04 11:14:04 +02:00
2026-05-01 17:40:22 +02:00
2026-06-04 18:37:32 -04:00
2026-06-28 20:46:23 -04:00
2026-05-08 20:48:36 +02:00
2026-05-01 17:40:22 +02:00
2026-05-01 17:40:22 +02:00