diff options
author | Thiago Macieira <thiago.macieira@intel.com> | 2022-01-31 11:00:19 -0800 |
---|---|---|
committer | Mårten Nordheim <marten.nordheim@qt.io> | 2022-02-28 11:18:36 +0100 |
commit | 851d69eebc717858f912081b24bd2223ed641aeb (patch) | |
tree | c1515d611c7f74c105d70c64a0753973270c70ed /tests/auto/corelib/codecs/qtextcodec/tst_qtextcodec.cpp | |
parent | 8539caf4e4196b550c4e5e5717ec65a96587c883 (diff) | |
download | qtbase-851d69eebc717858f912081b24bd2223ed641aeb.tar.gz |
QProcess/Unix: ensure we don't accidentally execute something from CWD
Unless "." (or the empty string) is in $PATH, we're not supposed to find
executables in the current directory. This is how the Unix shells behave
and we match their behavior. It's also the behavior Qt had prior to 5.9
(commit 28666d167aa8e602c0bea25ebc4d51b55005db13). On Windows, searching
the current directory is the norm, so we keep that behavior.
This commit does not add an explicit check for an empty return from
QStandardPaths::findExecutable(). Instead, we allow that empty string to
go all the way to execve(2), which will fail with ENOENT. We could catch
it early, before fork(2), but why add code for the error case?
See https://kde.org/info/security/advisory-20220131-1.txt
[ChangeLog][Important Behavior Changes] When passed a simple program
name with no slashes, QProcess on Unix systems will now only search the
current directory if "." is one of the entries in the PATH environment
variable. This bug fix restores the behavior QProcess had before Qt 5.9.
If launching an executable in the directory set by setWorkingDirectory()
or inherited from the parent is intended, pass a program name starting
with "./". For more information and best practices about finding an
executable, see QProcess' documentation.
Change-Id: I54f205f6b7314351b078fffd16cf7013c97ee9fb
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
(cherry picked from commit 29fceed2ffb41954a63001414bd042611f2d4980)
Reviewed-by: Jörg Bornemann <joerg.bornemann@qt.io>
Diffstat (limited to 'tests/auto/corelib/codecs/qtextcodec/tst_qtextcodec.cpp')
-rw-r--r-- | tests/auto/corelib/codecs/qtextcodec/tst_qtextcodec.cpp | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/tests/auto/corelib/codecs/qtextcodec/tst_qtextcodec.cpp b/tests/auto/corelib/codecs/qtextcodec/tst_qtextcodec.cpp index 62a8321844..f975b7300b 100644 --- a/tests/auto/corelib/codecs/qtextcodec/tst_qtextcodec.cpp +++ b/tests/auto/corelib/codecs/qtextcodec/tst_qtextcodec.cpp @@ -2099,6 +2099,15 @@ void tst_QTextCodec::toLocal8Bit() #if !QT_CONFIG(process) QSKIP("No qprocess support", SkipAll); #else + // Add the executable's directory to path so that we can find the test helper next to it + // in a cross-platform way. We must do this because the CWD is not pointing to this directory + // in debug-and-release builds. + QByteArray path = qgetenv("PATH"); + qputenv("PATH", + path + QDir::listSeparator().toLatin1() + + QCoreApplication::applicationDirPath().toLocal8Bit()); + auto restore = qScopeGuard([&] { qputenv("PATH", path); }); + QProcess process; process.start("echo_helper"); QString string(QChar(0x410)); |