On Wed, Jul 09, 2008 at 12:39:07PM +0200, Vincent Lefevre <[EMAIL PROTECTED]>
wrote:
> On 2008-07-09 11:01:03 +0200, Mike Hommey wrote:
> > On Thu, Jul 03, 2008 at 03:56:18PM +0200, Vincent Lefevre <[EMAIL
> > PROTECTED]> wrote:
> > > On 2008-07-02 20:05:11 +0200, Mike Hommey wrote:
> > > > Please run with the following environment variable set, and send output
> > > > here:
> > > >
> > > > NSPR_LOG_MODULES=HelperAppService:5
> > >
> > > Attached. Though evince doesn't appear in the contents, it is really
> > > evince that has been run (and appears in ps output).
> >
> > I see what is happening. There is no security issue there, only
> > inconvenience.
>
> There is *potential* security/data-loss problem, because the following
> points are cumulated:
> 1. Firefox runs a program (evince) while announcing something else.
> 2. The end user doesn't necessarily know that and doesn't necessarily
> even know GNOME's evince (he doesn't necessarily run GNOME: this
> is my case).
> 3. Because of point 2, the end user may have installed a program
> (possibly written by himself) named "evince" that could do
> destructive things. Of course, you may wonder whether or not this
> is likely to occur somewhere in practice, but "évince" is a French
> word that means "oust".
>
> IMHO, it is important that this bug is fixed before the next stable
> release (in fact, more for the inconvenience than for the potential
> security/data-loss problem).
>
> > Remove the xulrunner-1.9-gnome-support for a quick work around.
>
> OK, thanks for the information, but note that this is not possible on
> machines shared by several users, as some users may need it.
Can you try the attached patch against xulrunner ? (not tested ; I /think/
it should work and not break anything else, but I will have to do some
real testing)
Mike
diff --git a/uriloader/exthandler/unix/nsOSHelperAppService.cpp
b/uriloader/exthandler/unix/nsOSHelperAppService.cpp
index 39c4cb9..372405f 100644
--- a/uriloader/exthandler/unix/nsOSHelperAppService.cpp
+++ b/uriloader/exthandler/unix/nsOSHelperAppService.cpp
@@ -1391,7 +1391,7 @@ nsOSHelperAppService::GetFromExtension(const nsCString&
aFileExt) {
}
nsCAutoString mimeType(asciiMajorType + NS_LITERAL_CSTRING("/") +
asciiMinorType);
- nsMIMEInfoUnix* mimeInfo = new nsMIMEInfoUnix(mimeType);
+ nsMIMEInfoImpl* mimeInfo = new nsMIMEInfoImpl(mimeType);
if (!mimeInfo)
return nsnull;
NS_ADDREF(mimeInfo);
@@ -1556,7 +1556,7 @@ nsOSHelperAppService::GetFromType(const nsCString&
aMIMEType) {
return nsnull;
}
- nsMIMEInfoUnix* mimeInfo = new nsMIMEInfoUnix(aMIMEType);
+ nsMIMEInfoImpl* mimeInfo = new nsMIMEInfoImpl(aMIMEType);
if (!mimeInfo)
return nsnull;
NS_ADDREF(mimeInfo);
