Security: remove support for $(...) in config keys with [$e] marker.

Authored by dfaure on Aug 7 2019, 7:35 AM.

Description

Security: remove support for $(...) in config keys with [$e] marker.

Summary:
It is very unclear at this point what a valid use case for this feature
would possibly be. The old documentation only mentions $(hostname) as
an example, which can be done with $HOSTNAME instead.

Note that $(...) is still supported in Exec lines of desktop files,
this does not require [$e] anyway (and actually works better without it,
otherwise the $ signs need to be doubled to obey kconfig $e escaping rules...).

Test Plan:
ctest passes; various testcases with $(...) in desktop files,
directory files, and config files, no longer execute commands.

Reviewers: mdawson, aacid, broulik, davidedmundson, kossebau, apol, sitter, security-team

Reviewed By: mdawson, davidedmundson

Subscribers: ZaWertun, rikmills, fvogt, ngraham, kde-frameworks-devel

Tags: Frameworks

Differential Revision: https://phabricator.kde.org/D22979

Details

Committed
dfaureAug 7 2019, 2:04 PM
Reviewer
mdawson
Differential Revision
D22979: Security: remove support for $(...) in config keys with [$e] marker.
Parents
R237:8e82d5accb52: autotests: mkpath ~/.qttest/config
Branches
Unknown
Tags
Unknown