[konsole] [Bug 379294] Implement OSC 8 hyperlink support

[Martin Sandsmark]

https://bugs.kde.org/show_bug.cgi?id=379294

--- Comment #5 from Martin Sandsmark <martin.sandsmark at kde.org> ---
my point is that security is not binary, and security in depth is good.


in that hypothetical scenario with mutt you could put the blame on mutt all you
want for not filtering out this new escape sequence (or supporting it), it's
still a security issue that wouldn't be there without this.


as for the xdg-open thing; say you get xdg-open to launch via an URI handler
with the arguments %20--%20rm%20-f%20--no-preserve-root%20/, and get it to
launch gnome-terminal with the passed arguments. entry point could be a funnily
named file displayed by e. g. tab completion or something else non-obvious,
since one of the use example functioning cases is clicking on files displayed
by ls. (fwiw, konsole already supports clicking on filenames by tracking the
current directory + known mimetypes, without the security issues.)

but again; not a clear cut place to put the blame, but wouldn't be possible
without this.


basically; everywhere I see this could be useful it is a decrease in security,
providing a new possible part of an exploit chain.

-- 
You are receiving this mail because:
You are the assignee for the bug.