dir: Validate Desktop Entry and D-Bus Service

Browse Source

D-Bus Services and Desktop Entries could be extended
through custom keys. D-Bus daemons and desktop
environments augment Applications this way

Besides validating Exec= and D-Bus Service Name=, these
could lead to denial of service, e.g. X-GNOME-AutoRestart
in Desktop Entries, or even code exection outside the
sandbox, e.g. SystemdService in D-Bus Services.

The only reasonable way to ensure non of these make it
through, is exporting only know acceptable ones, instead
of hoping to aggregate every problematic one.

See: https://specifications.freedesktop.org/desktop-entry/latest/index.html
See: https://dbus.freedesktop.org/doc/dbus-specification.html

Resolves: CVE-2026-97027
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-v64f-hrwr-j4vh
Signed-off-by: Markus Göllnitz <camelcasenick@bewares.it>
[smcv: Added CVE ID]
Signed-off-by: Simon McVittie <smcv@collabora.com>

...

This commit is contained in:

500 Internal Server Error

Gitea Version: 1.28.0+dev-477-g8b6ad49a5f