Hot Keys feature: special shell characters not escaped in %f macros

[Andrew Chadwick]

Binary package hint: gthumb

The Feisty version of gthumb does not escape all special shell characters passed via the %f macro of the new Hot Keys feature. In particular ">" and "<" are not escaped, although spaces and other special characters are.

Might be a security issue if users are receiving files with these characters from an untrusted source.

Steps to reproduce:

  ; Open a Terminal. In it type:
  $ mkdir /tmp/a
  $ cd /tmp/a
  $ cp /var/www/apache2-default/apache_pb.png 'foo>bif bam.png'
  ; you can of course copy any image file you like.
  $ gthumb 'foo>bif bam.png'
  ; In GThumb, navigate to Edit>Preferences>Hot Keys,
  ; then change hot-key 0 to:
  ; echo %f
  ; and press Close.
  ; Click on the displayed image to select it.
  ; Press numpad-zero.
  ; Note nothing is echoed to the terminal.
  ; Press ctrl+w to exit.
  $ ls -l
  total 8
  -rw-rw---- 1 testuser users 11 2007-06-10 23:18 bif bam.png
  -rw-r----- 1 testuser users 1385 2007-06-10 23:16 foo>bif bam.png
  $ cat 'bif bam.png'
  /tmp/a/foo
  $

Expected behaviour:

The full path of the file is echoed to the terminal, and no new file is created in the test directory.

Observed behaviour:

Nothing is echoed to the Terminal, and a new file is created within the directory.

More observations:

It's useless to quote the "%f" with either single or double quotes: this doesn't result in anything the shell will expand to the correct filename. It doesn't work like that; note that spaces are escaped properly before passing to the shell. Further playing around reveals behaviour corresponding to "$", "|", and spaces being escaped properly, but not angle brackets.

[mjc (mjc-avtechpulse)]

Yuck, why would you put angle brackets in a filename?

Anyway, gThumb has been patched to escape angle brackets (http://svn.gnome.org/viewcvs/gthumb?rev=1692&view=rev). The fix should appear in 2.10.4.

- Mike

[Áron Sisak (asisak)]

gthumb (3:2.10.4-0ubuntu1) gutsy; urgency=low

  * New upstream release:
    * Fixed Bug 432759 - update of the thumbnail index when files are
      added. Properly generates thumbnails for slowly generated files
      (e.g., files from a slow scanner, or oscilloscope images sent
      over a serial port).
    * Deleted unused functions: thumb_loader_get_max_file_size,
      thumb_loader_get_path, thumb_loader_set_uri, thumb_loader_get_uri,
      thumb_loader_get_image_loader.
    * When generating a new thumbnail, scale the image only if the
      original size is larger than the requested size.
    * Fixed Bug #440036 - index image maps are not xhtml compliant
    * Fixed Bug #438716 - IPTC comments are not seen by Picasa
    * Fixed Bug #444656 - write folders to CD does not work
    * Fixed Bug #446133 - Add PPM to supported types during import
    * Fixed Bug "Escape angle brackets in filenames" (LP: #119769)
    * Fixed Bug #447311 - g_thread_init warning when starting gthumb

 -- Aron Sisak <email address hidden> Wed, 20 Jun 2007 15:28:31 +0200