Skip to content
GitLab
Projects Groups Topics Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Register
  • Sign in
  • G GLib
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
  • Issues 875
    • Issues 875
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 58
    • Merge requests 58
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Artifacts
    • Schedules
  • Deployments
    • Deployments
    • Releases
  • Packages and registries
    • Packages and registries
    • Container Registry
    • Model experiments
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • GNOMEGNOME
  • GLib
  • Issues
  • #1904

gaction: remote triggered crashes

GApplication makes it easy to export actions on the bus.

But nothing in the GAction machinery does any careful parameter type checks, which makes it trivial to trigger crashes in apps that export actions. Traditionally, we treat the session bus as a single security domain, but with sandboxed apps, this is a little different. In any case, trivially triggerable crashes are bad news.

For example:

gdbus call --session --dest org.gnome.ControlCenter --object-path /org/gnome/ControlCenter --method org.gtk.Actions.Activate "launch-panel" [\<1\>] []

yields

(gnome-control-center:8069): GLib-GIO-CRITICAL **: 20:29:01.241: g_simple_action_activate: assertion 'simple->parameter_type == NULL ? parameter == NULL : (parameter != NULL && g_variant_is_of_type (parameter, simple->parameter_type))' failed
Edited Oct 04, 2019 by Matthias Clasen
Assignee
Assign to
Time tracking