FIX: Arbitrary Code Injection in the saved places

setup.py

@@ -12,12 +12,13 @@ def create_mo_files():
     mo = []
     for po in os.listdir(podir):
         if po.endswith(".po"):
-            os.makedirs("{}/{}/LC_MESSAGES".format(podir, po.split(".po")[0]), exist_ok=True)
-            mo_file = "{}/{}/LC_MESSAGES/{}".format(podir, po.split(".po")[0], "pardus-mycomputer.mo")
-            msgfmt_cmd = 'msgfmt {} -o {}'.format(podir + "/" + po, mo_file)
-            subprocess.call(msgfmt_cmd, shell=True)
-            mo.append(("/usr/share/locale/" + po.split(".po")[0] + "/LC_MESSAGES",
-                       ["po/" + po.split(".po")[0] + "/LC_MESSAGES/pardus-mycomputer.mo"]))
+            lang = po[:-3]
+            local_dir = os.path.join(podir, lang, "LC_MESSAGES")
+            os.makedirs(local_dir, exist_ok=True)
+            mo_file = os.path.join(local_dir, "pardus-mycomputer.mo")
+
+            subprocess.call(["msgfmt", os.path.join(podir, po), "-o", mo_file])
+            mo.append((f"/usr/share/locale/{lang}/LC_MESSAGES", [mo_file]))
     return mo
 
 

src/DiskManager.py

@@ -49,51 +49,62 @@ def get_file_info(file, network=False):
 
 
 def get_uuid_from_dev(dev_path):
-    process = subprocess.run(f"lsblk -o PATH,UUID --raw | grep {dev_path}", shell=True, capture_output=True)
-
-    if process.returncode != 0:
+    result = subprocess.run(["lsblk", "-o", "PATH,UUID", "--raw"], capture_output=True, text=True)
+    if result.returncode != 0:
         return ""
-
-    uuid = process.stdout.decode("utf-8").strip().split(" ")[1]
-    return uuid
+    for line in result.stdout.splitlines():
+        parts = line.strip().split()
+        if len(parts) >= 2 and parts[0] == dev_path:
+            return parts[1]
+    return ""
 
 
 def is_drive_automounted(dev_path):
     uuid = get_uuid_from_dev(dev_path)
-
-    process = subprocess.run(f'grep -E "{dev_path}|{uuid}" /etc/fstab | grep -v -E "#.*({dev_path}|{uuid})"',
-                             shell=True, capture_output=True)
-
-    if process.returncode != 0:
+    try:
+        with open("/etc/fstab", "r") as f:
+            for line in f:
+                if line.strip().startswith('#'):
+                    continue
+                if dev_path in line or (uuid and uuid in line):
+                    return True
+    except Exception:
         return False
-
-    return True
+    return False
 
 
 def set_automounted(dev_path, value):
     if value and not is_drive_automounted(dev_path):
-        partition = dev_path.split("/")[-1]  # /dev/sda1 -> sda1
-        fstab_string = f"{dev_path} /mnt/{partition} auto nosuid,nodev,nofail,x-gvfs-show 0 0"
+        partition = dev_path.split("/")[-1] # /dev/sda1 -> sda1
+        fstab_string = f"{dev_path} /mnt/{partition} auto nosuid,nodev,nofail,x-gvfs-show 0 0\n"
 
-        process = subprocess.run(f'echo "{fstab_string}" | pkexec tee -a /etc/fstab', shell=True)
+        subprocess.run(["pkexec", "tee", "-a", "/etc/fstab"], input=fstab_string, text=True)
 
     elif not value and is_drive_automounted(dev_path):
-        partition = dev_path.split("/")[:-1]  # /dev/sda1 -> sda1
         uuid = get_uuid_from_dev(dev_path)
 
-        dev_path_backslashes = dev_path.replace("/", "\/")
-        cmd = f"pkexec sed -ri 's/.*({dev_path_backslashes}|{uuid}).*//g' /etc/fstab"
-        process = subprocess.run(cmd, shell=True)
+        try:
+            with open("/etc/fstab", "r") as f:
+                lines = [l for l in f if dev_path not in l and (not uuid or uuid not in l)]
+            tmpfile = "/tmp/fstab.tmp"
+            with open(tmpfile, "w") as tf:
+                tf.writelines(lines)
+            subprocess.run(["pkexec", "mv", tmpfile, "/etc/fstab"])
+        except Exception:
+            pass
 
 
 def get_filesystem_of_partition(partition_path):
-    process = subprocess.run(f'lsblk -o TYPE,PATH,FSTYPE -r | grep " {partition_path} "', shell=True,
-                             capture_output=True)
 
-    output = process.stdout.decode("utf-8").strip()
-    if output == "":
+    result = subprocess.run(["lsblk", "-o", "TYPE,PATH,FSTYPE", "-r"], capture_output=True, text=True)
+    if result.returncode != 0:
         return "-"
-    return output.split(" ")[2]
+    for line in result.stdout.splitlines():
+        parts = line.strip().split()
+        if len(parts) >= 3 and parts[1] == partition_path:
+            return parts[2]
+
+    return "-"
 
 # import subprocess, threading
 #

src/MainWindow.py

@@ -1620,7 +1620,8 @@ def on_btn_mount_clicked(self, button):
             if isinstance(mount, str):
                 self.on_btn_mount_connect_clicked(button=None, from_saved=True, saved_uri=mount)
             else:
-                subprocess.run(["xdg-open", mount.get_root().get_path()])
+
+                subprocess.Popen(["xdg-open", mount.get_root().get_path()])
 
     def on_btn_unmount_clicked(self, button):
         self.actioned_volume = button
@@ -1768,12 +1769,12 @@ def on_volume_row_activated(self, listbox, row):
             if isinstance(mount, str):
                 self.on_btn_mount_connect_clicked(button=None, from_saved=True, saved_uri=mount)
             else:
-                th = subprocess.Popen("xdg-open '{}' &".format(mount.get_root().get_path()), shell=True)
-                th.communicate()
+
+                subprocess.Popen(["xdg-open", mount.get_root().get_path()])
 
                 # some times phone's disk usage infos not showing on first mount,
                 # we can update this values on phone row clicked
-                # fix this late
+                # fix this later
                 if row._type == "phone":
                     self.showVolumeSizes(row)
 
@@ -2122,8 +2123,8 @@ def on_mounted(source_object, res):
                     print("operation cancelled")
                 else:
                     if from_places:
-                        th = subprocess.Popen("xdg-open '{}' &".format(saved_uri), shell=True)
-                        th.communicate()
+
+                        subprocess.Popen(["xdg-open", saved_uri])
                         if self.UserSettings.config_closeapp_main:
                             self.on_window_delete_event(self.window)
                     else: