[plasmashell] [Bug 524243] New: Folder View at a file:// URL labels .desktop files by filename, not Name=

https://bugs.kde.org/show_bug.cgi?id=524243

            Bug ID: 524243
           Summary: Folder View at a file:// URL labels .desktop files by
                    filename, not Name=
    Classification: Plasma
           Product: plasmashell
      Version First 6.6.6
       Reported In:
          Platform: Kubuntu
                OS: Linux
            Status: REPORTED
          Severity: normal
          Priority: NOR
         Component: Folder View widget
          Assignee: [email protected]
          Reporter: [email protected]
                CC: [email protected]
  Target Milestone: 1.0

Product: plasmashell · Component: Folder View widget · Severity: normal

SUMMARY

A Folder View widget pointed at a plain file:// directory containing .desktop
files renders each entry's filename (org.kicad.pcbnew.desktop) rather than its
Name= field (PCB Editor). The same files shown through desktop:/ are labelled
correctly.

STEPS TO REPRODUCE

1. mkdir ~/Desktop/Apps, copy several launchers into it —
org.kicad.pcbnew.desktop makes the mismatch obvious since the filename and the
display name share nothing.
2. Add a Folder View widget, set its location to
file:///home/$USER/Desktop/Apps.
3. Compare against a Folder View pointed at desktop:/Apps.

OBSERVED RESULT

file:// shows org.kicad.pcbnew.desktop. desktop:/ shows PCB Editor.

EXPECTED RESULT

Consistent labelling between the two URL schemes.

ADDITIONAL INFORMATION

This may be intentional — withholding Name= from untrusted .desktop files is a
recognised anti-spoofing measure, and if so this should be closed as NOTABUG.
One observation that argues against that reading: the icon from the same
.desktop file resolves and renders correctly. A trust boundary that displays
the attacker-controlled icon while suppressing the attacker-controlled name is
not obviously protecting anything, so if this is deliberate the inconsistency
may still be worth a look.

-- 
You are receiving this mail because:
You are watching all bug changes.