KDE Plasma Had A Silly But Serious Security Bug

[ferry]

On the last lenghty GTK 4 discussion on Phoronix, people were saying that GTK and GNOME don't get enough quality testing and stuff and that Qt and KDE did. But this seems like something that could've been avoided by proper testing, so it seems like Qt/KDE doesn't get as properly tested as people claimed.

And there we go ...

[Azrael5]

Is PLASMA 5.12 available?

[rtfazeberdee]

Is PLASMA 5.12 available?

certainly is on opensuse tumbleweed

[Azrael5]

certainly is on opensuse tumbleweed

many thanks for the answer, how to get it?

[Steffo]

LOL https://twitter.com/q3k/status/961581995414511617

Holy shit! goto code and as many if else instructions as you can find sand on the beach!

[angrypie]

Holy shit! goto code and as many if else instructions as you can find sand on the beach!

Oh look, a moronic Moronix user hating on goto like it's 1980.

Patches welcome, as they say. But you can't even read code, obviously.

[timofonic]

Oh look, a moronic Moronix user hating on goto like it's 1980.

Patches welcome, as they say. But you can't even read code, obviously.

Can you?

[halo9en]

Can you?

Come on, leave the poor troll alone. 9 posts and the best he could say is everybody "needs a GTX1080 just for Mutter".

[Delgarde]

Patiently waiting for comments on KDE code quality...

To be fair, this kind of bug is appalling incompetence from any developer, regardless of what desktop you favour. Seriously, running shell commands without proper escaping would have been a careless error twenty years ago... anyone doing development this decade needs to be absolutely paranoid about this kind of thing...

[agaman]

LOL https://twitter.com/q3k/status/961581995414511617

I don't get why KDE executes volume names with bash.

The fix should not be to escape the command. They should remove that insecure code and never execute strings readed from anywhere.