From 972804f22291f89202e41b33f43d8e0ea64dcbee Mon Sep 17 00:00:00 2001
From: Matthias Clasen <mclasen@redhat.com>
Date: Fri, 30 Nov 2018 20:31:39 -0500
Subject: [PATCH] session-helper: Validate HostCommand arguments

This is not a portal, but we should still do some
due diligence.

Closes: #2365
Approved by: alexlarsson
---
 session-helper/flatpak-session-helper.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/session-helper/flatpak-session-helper.c b/session-helper/flatpak-session-helper.c
index ce0e942e..7416b0de 100644
--- a/session-helper/flatpak-session-helper.c
+++ b/session-helper/flatpak-session-helper.c
@@ -235,6 +235,16 @@ handle_host_command (FlatpakDevelopment    *object,
       return TRUE;
     }
 
+  if (!g_variant_is_of_type (arg_fds, G_VARIANT_TYPE ("a{uh}")) ||
+      !g_variant_is_of_type (arg_envs, G_VARIANT_TYPE ("a{ss}")) ||
+      (flags & ~FLATPAK_HOST_COMMAND_FLAGS_CLEAR_ENV) != 0)
+    {
+      g_dbus_method_invocation_return_error (invocation, G_DBUS_ERROR,
+                                             G_DBUS_ERROR_INVALID_ARGS,
+                                             "Unexpected argument");
+      return TRUE;
+    }
+
   g_debug ("Running host command %s", arg_argv[0]);
 
   n_fds = 0;