fix(eventlog): 修复 .desktop 文件名命令注入漏洞#1113
Merged
robertkill merged 1 commit intoMay 20, 2026
Merged
Conversation
… lookup
Use exec.Command("dpkg", "-S", desktop) directly instead of
exec.Command("/bin/bash", "-c", ...) to prevent shell metacharacter
expansion in the desktop file path.
A malicious .desktop file named e.g. $(cmd).desktop would have the
embedded command executed when the application is launched and eventlog
tries to look up its package name via dpkg.
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR fixes a command injection vulnerability in the session/eventlog module by changing how dpkg is executed to resolve .desktop file ownership, avoiding shell interpretation of potentially malicious filenames. Sequence diagram for dpkg invocation change in appEventCollectorsequenceDiagram
participant appEventCollector
participant OS
appEventCollector->>OS: exec.Command("/bin/bash", "-c", "dpkg -S desktop")
OS-->>appEventCollector: cmd.Output()
alt After_fix
appEventCollector->>OS: exec.Command("dpkg", "-S", desktop)
OS-->>appEventCollector: cmd.Output()
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
deepin pr auto review你好！我是CodeGeeX。我已仔细审查了你提供的 Git Diff 代码。 这次修改的核心是将通过 1. 语法与逻辑 (语法正确，逻辑有改进空间)
2. 代码质量 (建议增加输入校验与错误处理)
3. 代码性能 (表现良好)
4. 代码安全 (显著提升，但仍有防御空间)
💡 改进建议及重构代码结合以上分析，建议对代码进行如下加固：
改进后的代码示例： // 确保路径非空且有效（结合上文，desktop 应该已经是绝对路径）
if desktop == "" {
logger.Warningf("desktop path is empty, skip dpkg query")
return // 或 continue，取决于外层逻辑
}
// 直接执行命令，无需 bash -c
cmd := exec.Command("dpkg", "-S", desktop)
logger.Debugf("dpkg command is %v", cmd)
// 使用 CombinedOutput 捕获输出和错误，防止 dpkg 的错误信息打印到宿主进程的 stderr
buf, err := cmd.CombinedOutput()
if err != nil {
// 如果是命令不存在
if errors.Is(err, exec.ErrNotFound) {
logger.Warningf("dpkg command not found in system")
return
}
// dpkg -S 找不到对应包时也会返回 err (exit status 1)
// 此时的 buf 中包含了 dpkg 提示的 "no path found matching pattern" 等信息
logger.Debugf("dpkg query failed for %s: %v, output: %s", desktop, err, strings.TrimSpace(string(buf)))
return
}
// 正常处理 buf (包名信息)
packageName := strings.TrimSpace(string(buf))
logger.Debugf("found package: %s for desktop: %s", packageName, desktop)总结：你的修改方向非常正确，成功修复了潜在的命令注入漏洞并提升了性能。在此基础上，增加边界条件检查和更完善的错误处理，将使这段代码达到生产级别的健壮性。 |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
fly602
approved these changes
May 20, 2026
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: fly602, robertkill The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
session/eventlog 模块中，
getPackageName使用exec.Command("/bin/bash", "-c", ...)执行dpkg -S查询归属包。当 .desktop 文件名包含 shell 元字符（如 $(cmd)）时，会被 bash 展开执行。修复
将
exec.Command("/bin/bash", "-c", strings.Join(dpkg, " "))改为exec.Command("dpkg", "-S", desktop)，直接传递参数给系统调用，不经过 shell 解释。受影响版本
6.1.89 及 master 分支均存在此问题。
测试
安全说明
dde-session-daemon 以用户权限运行（非 root），此漏洞不构成提权，但属于应在 code review 中消灭的代码模式。
Summary by Sourcery
Bug Fixes: