Re: Packages providing Flatpak sandbox escapes via vulnerable MIME Type Handler

On 7/7/26 8:46 AM, Neal Gompa wrote:
> On Tue, Jul 7, 2026 at 8:36 AM Sebastian Wick <[email protected]> wrote:
>> ....
>>
>> They argue that this can't be an issue on their side because this
>> behavior was introduced in 2004. The behavior was never a good idea
>> (see man 1 xdg-mime above). The handler that wine ships also bypasses
>> the executable bit. If you download an ELF or sh file in your browser
>> and open it, it will not run. If you download an exe, it will.
>>
>> Fedora has a responsibility to keep their users secure. We have to
>> patch the desktop file in wine to remove the MIME handler.
>>
> 
> I don't entirely agree with this assessment. Fixing the handler so
> that it doesn't execute it if it's not marked executable would largely
> mitigate this problem too. But yes, I also agree with the Wine folks
> that users expect double-clicking to work, so that behavior needs to
> remain in effect.
> 
> 
Users expecting double clicking to work is the main cause of malware 
problem in Windows, where the originator of the file is who decides what 
is executable or not by naming the file with an specific extension.

If Wine authors do not want to solve the problem upstream, not only the 
Fedora provided Wine should be fixed downstream by not registering the 
handler, I go a little far that that. Disallow a default handler for 
Wine related mime types to avoid compromising the system for people that 
install the upstream RPMs, make the users choose the handler every time 
and add a non GUI option to disable that at their own expense.
-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new