oss-sec mailing list archives

Re: PCManFM-Qt allows arbitrary files to be opened via the org.freedesktop.FileManager1.ShowFolders method


From: gabriel.corona () free fr
Date: Wed, 20 May 2026 12:41:23 +0200

Checking whether a path is a file or
directory can block I/O under special circumstances; so, it isn't an
option in this case."

I am not sure I am following that argument …

When I am calling "$file-manager $some-path", I should be expecting to actually open up a file manager not something else which happens to actually handle the file.
The file manager should not try to delegate to another program at all.

If we want the "automagically call the correct program" functionality,
we can use xdg-open / kde-open / dde-open / gnome-open / exo-open /
org.freedesktop.portal.OpenURI.OpenFile.

Gabriel


Current thread: