andrius
/
kpmcore
1
0
Fork 0
Code Pull Requests Releases Activity

Restrict QProcess::ProcessChannelMode to two used values. 

Casting and passing the processChannel argument unfiltered to QProcess
could pose a security issue if future additions are made to
QProcess that introduce new behaviour.
This commit is contained in:
Andrius Štikonas 2022-02-05 13:24:38 +00:00
parent 1502494eda
commit 5d1c03b9d8
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/util/externalcommandhelper.cpp
View File

@ -334,6 +334,11 @@ QVariantMap ExternalCommandHelper::RunCommand(const QString& command, const QStr
QProcess cmd;
cmd.setEnvironment( { QStringLiteral("LVM_SUPPRESS_FD_WARNINGS=1") } );
if((processChannelMode != QProcess::SeparateChannels) && (processChannelMode != QProcess::MergedChannels)) {
reply[QStringLiteral("success")] = false;
return reply;
}
cmd.setProcessChannelMode(static_cast<QProcess::ProcessChannelMode>(processChannelMode));
cmd.start(command, arguments);
cmd.write(input);