Ryan Hughes
eb988b42e6
A free-form shell-string --exec sitting next to the safe --exec-arg is a standing invitation for the next caller to interpolate untrusted data and reintroduce the RCE. Remove it: omarchy-notification-send --exec now errors and points at --exec-arg, and the shell drops the omarchy-exec string hint and its bash -lc execution path, leaving only the argv path. Migrate the remaining string callers (the first-run invitation hooks, wifi and welcome prompts) to --exec-arg, and update their notification mocks. Trim the verbose security comments added along the way.
31 lines
1.2 KiB
Bash
31 lines
1.2 KiB
Bash
notify_update() {
|
|
omarchy-notification-send -u critical -g "Update System" "Click to update the system." \
|
|
--exec-arg omarchy-launch-floating-terminal-with-presentation --exec-arg omarchy-update
|
|
}
|
|
|
|
notify_wifi() {
|
|
omarchy-notification-send -u critical -g "Setup Wi-Fi" "Click to configure the wireless network." \
|
|
--exec-arg omarchy-shell --exec-arg shell --exec-arg toggle --exec-arg omarchy.network
|
|
}
|
|
|
|
announce_network() {
|
|
# Ethernet is still negotiating DHCP when the session starts, so probing
|
|
# right away calls a working machine offline. NetworkManager reports startup
|
|
# complete once it has tried every connection it could auto-activate, which
|
|
# is the first moment the answer means anything.
|
|
nm-online -q -s -t 30
|
|
|
|
# -x takes that answer as it stands rather than waiting out the timeout, so
|
|
# a laptop with nothing to connect to gets prompted immediately.
|
|
if ! nm-online -q -x -t 30; then
|
|
notify_wifi
|
|
# Nothing to update against until a link lands, so hold that prompt.
|
|
nm-online -q -t 3600 || return
|
|
fi
|
|
|
|
notify_update
|
|
}
|
|
|
|
# Detached, so a slow or absent connection never holds up the rest of first run.
|
|
announce_network &
|