[rpms/glib2] cve-2026-58016-f44: - Only pass URI's for gio apps (#442835)

[David Zeuthen <davidz@fedoraproject.org>]

A new commit has been pushed.

Repo   : rpms/glib2
Branch : cve-2026-58016-f44
Commit : 58ed49b93fac27af091cfedfb98aa8e55702e365
Author : David Zeuthen <davidz@fedoraproject.org>
Date   : 2008-04-17T23:49:13+00:00
Stats  : +118/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/glib2/c/58ed49b93fac27af091cfedfb98aa8e55702e365?branch=cve-2026-58016-f44

Log:
- Only pass URI's for gio apps (#442835)

---
diff --git a/gio-2.16-only-pass-uri-to-gio-apps.patch b/gio-2.16-only-pass-uri-to-gio-apps.patch
new file mode 100644
index 0000000..f646710
--- /dev/null
+++ b/gio-2.16-only-pass-uri-to-gio-apps.patch
@@ -0,0 +1,110 @@
+Index: gio/gdesktopappinfo.c
+===================================================================
+--- gio/gdesktopappinfo.c	(revision 6851)
++++ gio/gdesktopappinfo.c	(working copy)
+@@ -1,3 +1,5 @@
++/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*- */
++
+ /* GIO - GLib Input, Output and Streaming Library
+  * 
+  * Copyright (C) 2006-2007 Red Hat, Inc.
+@@ -87,6 +89,7 @@
+   char *exec;
+   char *binary;
+   char *path;
++  char *vfs_system;
+ 
+   guint nodisplay       : 1;
+   guint hidden          : 1;
+@@ -149,6 +152,7 @@
+   g_free (info->try_exec);
+   g_free (info->exec);
+   g_free (info->binary);
++  g_free (info->vfs_system);
+   g_free (info->path);
+   
+   G_OBJECT_CLASS (g_desktop_app_info_parent_class)->finalize (object);
+@@ -264,6 +268,7 @@
+   info->terminal = g_key_file_get_boolean (key_file, G_KEY_FILE_DESKTOP_GROUP, G_KEY_FILE_DESKTOP_KEY_TERMINAL, NULL) != FALSE;
+   info->startup_notify = g_key_file_get_boolean (key_file, G_KEY_FILE_DESKTOP_GROUP, G_KEY_FILE_DESKTOP_KEY_STARTUP_NOTIFY, NULL) != FALSE;
+   info->hidden = g_key_file_get_boolean (key_file, G_KEY_FILE_DESKTOP_GROUP, G_KEY_FILE_DESKTOP_KEY_HIDDEN, NULL) != FALSE;
++  info->vfs_system = g_key_file_get_string (key_file, G_KEY_FILE_DESKTOP_GROUP, "X-Gnome-Vfs-System", NULL);
+ 
+   g_key_file_free (key_file);
+   
+@@ -498,9 +503,35 @@
+ {
+   GList *uris = *uri_list;
+   char *expanded;
+-  
++  gboolean force_file_uri;
++  char force_file_uri_macro;
++
+   g_return_if_fail (exec != NULL);
+-  
++
++  /* On %u and %U, only pass gio URI's if the desktop file has the
++   * X-Gnome-Vfs-System key set to 'gio' or if FUSE is not available.
++   * Otherwise we pass in a POSIX file path pointing to the URI via
++   * the FUSE mount in ~/.gvfs.
++   */
++  force_file_uri = FALSE;
++  if (macro == 'u' || macro == 'U')
++    {
++      if (info->vfs_system == NULL || strcmp (info->vfs_system, "gio") != 0)
++        {
++          switch (macro)
++            {
++            case 'u':
++              force_file_uri_macro = 'f';
++              force_file_uri = TRUE;
++              break;
++            case 'U':
++              force_file_uri_macro = 'F';
++              force_file_uri = TRUE;
++              break;
++            }
++        }
++    }
++
+   switch (macro)
+     {
+     case 'u':
+@@ -509,7 +540,17 @@
+     case 'n':
+       if (uris)
+ 	{
+-	  expanded = expand_macro_single (macro, uris->data);
++          if (!force_file_uri || g_str_has_prefix (uris->data, "http"))
++            {
++              expanded = expand_macro_single (macro, uris->data);
++            }
++          else
++            {
++              expanded = expand_macro_single (force_file_uri_macro, uris->data);
++              if (expanded == NULL)
++                expanded = expand_macro_single (macro, uris->data);
++            }
++
+ 	  if (expanded)
+ 	    {
+ 	      g_string_append (exec, expanded);
+@@ -526,7 +567,17 @@
+     case 'N':
+       while (uris)
+ 	{
+-	  expanded = expand_macro_single (macro, uris->data);
++          if (!force_file_uri || g_str_has_prefix (uris->data, "http"))
++            {
++              expanded = expand_macro_single (macro, uris->data);
++            }
++          else
++            {
++              expanded = expand_macro_single (force_file_uri_macro, uris->data);
++              if (expanded == NULL)
++                expanded = expand_macro_single (macro, uris->data);
++            }
++
+ 	  if (expanded)
+ 	    {
+ 	      g_string_append (exec, expanded);

diff --git a/glib2.spec b/glib2.spec
index f54b693..91de2d3 100644
--- a/glib2.spec
+++ b/glib2.spec
@@ -3,7 +3,7 @@
 Summary: A library of handy utility functions
 Name: glib2
 Version: 2.16.3
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: LGPLv2+
 Group: System Environment/Libraries
 URL: http://www.gtk.org
@@ -26,6 +26,9 @@ Patch0: appinfo.patch
 # committed on March 12, 2008
 Patch1: revert-316221.patch
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=442835
+Patch2: gio-2.16-only-pass-uri-to-gio-apps.patch
+
 %description 
 GLib is the low-level core library that forms the basis
 for projects such as GTK+ and GNOME. It provides data structure
@@ -59,6 +62,7 @@ of version 2 of the GLib library.
 %setup -q -n glib-%{version}
 %patch0 -p1 -b .appinfo
 %patch1 -R -p1 -b .revert-316221
+%patch2 -p0 -b .only-pass-uri-to-gio-apps
 
 %build
 %configure --disable-gtk-doc --enable-static 
@@ -131,6 +135,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/lib*.a
 
 %changelog
+* Thu Apr 17 2008 David Zeuthen <davidz@redhat.com> - 2.16.3-4
+- Only pass URI's for gio apps (#442835)
+
 * Sun Apr 13 2008 Dan Williams <dcbw@redhat.com> - 2.16.3-3
 - Revert upstream changes to g_static_mutex_get_mutex_impl_shortcut that broke
     users of GMutex and GStaticMutex (bgo#316221)