Ryan Hughes
eb988b42e6
A free-form shell-string --exec sitting next to the safe --exec-arg is a standing invitation for the next caller to interpolate untrusted data and reintroduce the RCE. Remove it: omarchy-notification-send --exec now errors and points at --exec-arg, and the shell drops the omarchy-exec string hint and its bash -lc execution path, leaving only the argv path. Migrate the remaining string callers (the first-run invitation hooks, wifi and welcome prompts) to --exec-arg, and update their notification mocks. Trim the verbose security comments added along the way.
12 lines
470 B
Bash
12 lines
470 B
Bash
#!/bin/bash
|
|
|
|
set -e
|
|
|
|
# Omarchy ships no default agent, so invite once rather than picking one. An
|
|
# agent already chosen means the invitation has nothing to offer.
|
|
if [[ -z $(omarchy-default-agent) ]] && omarchy-done ensure agent-setup-invitation; then
|
|
omarchy-notification-send -u critical -g "Set your default agent" \
|
|
"Let your favorite agent help with Omarchy." \
|
|
--exec-arg omarchy --exec-arg menu --exec-arg summon --exec-arg setup.default.agent
|
|
fi
|