Re: Security Issue of .desktop files
On Tue, 24 Feb 2009 19:09:42 -0300, Daniel Ruoso wrote:
> > > So if a .desktop file appears in the user's Desktop without the x bit
> > > set and the user clicks it, it won't get executed..
> > Not exactly. The “safe” .desktop file was in the link I pasted on
> > another mail in the thread:
>
> So if the launcher use a plain name like "Nude Shots", it will get
> executed?
I think I need to retract my previous statement. It looks like the XFCE
desktop itself is fairly safe (since it never actually
executes .desktop files), but thunar isn't. For example, here is
a .desktop file that looks like it is iceweasel, but really it
downloads an essentially random file, but I could have made it do
pretty much anything.
<filename: random.desktop>
[Desktop Entry]
Version=1.0
Name=Iceweasel
Exec=wget http://people.debian.org/~joeyh/d-i/images/daily/stats.txt
Icon=/usr/share/pixmaps/iceweasel.png
The user is not warned that this may be malicious, it has the
iceweasel icon and name, and runs without prompt when clicked on in
thunar.
Mike
Reply to: