https://bugs.kde.org/show_bug.cgi?id=522017
--- Comment #3 from [email protected] --- To me it's a bug and it might be a candidate as security bug. Exec=xdg-open "/my/path/to/myffmpeg-help.md" #%U is proof that: some know the behavior is surprising some know it breaks service menus some know it needs a workaround some know it’s not ideal Exec=xdg-open "/my/path/to/myffmpeg-help.md" people expect exactly one argument. Dolphin silently adding a second argument violates: developer expectations user expectations consistency with other desktop environments consistency with KDE’s own .desktop spec Now imagine a malicious filename: "; rm -rf ~; echo " I'm not facing trying on this machine and see whether or not Dolphin has a command injection risk -- You are receiving this mail because: You are watching all bug changes.
