From dea4dea1fd4228dba4d674b780b97544637bdec3 Mon Sep 17 00:00:00 2001
From: James Henstridge <james@jamesh.id.au>
Date: Fri, 11 Aug 2023 11:44:49 +0800
Subject: [PATCH] desktop/desktopentry: add more tests for file URI checks, and
 special characters within file paths

---
 desktop/desktopentry/expand_exec.go      |  4 ++++
 desktop/desktopentry/expand_exec_test.go | 14 ++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/desktop/desktopentry/expand_exec.go b/desktop/desktopentry/expand_exec.go
index 92a7f94a6f0..4396faaec6e 100644
--- a/desktop/desktopentry/expand_exec.go
+++ b/desktop/desktopentry/expand_exec.go
@@ -23,6 +23,7 @@ import (
 	"bytes"
 	"fmt"
 	"net/url"
+	"path/filepath"
 	"strings"
 
 	"github.com/snapcore/snapd/strutil/shlex"
@@ -43,6 +44,9 @@ func toFilePath(uri string) (string, error) {
 	if u.Scheme != "file" {
 		return "", fmt.Errorf("%q is not a file URI", uri)
 	}
+	if !filepath.IsAbs(u.Path) {
+		return "", fmt.Errorf("%q does not have an absolute file path", uri)
+	}
 	return u.Path, nil
 }
 
diff --git a/desktop/desktopentry/expand_exec_test.go b/desktop/desktopentry/expand_exec_test.go
index 7d2bafaed06..8272952f9cc 100644
--- a/desktop/desktopentry/expand_exec_test.go
+++ b/desktop/desktopentry/expand_exec_test.go
@@ -110,6 +110,20 @@ func (s *desktopentrySuite) TestExpandExecHelper(c *C) {
 		in:   `foo %f`,
 		uris: []string{"foo/bar"},
 		err:  `"foo/bar" is not an absolute URI`,
+	}, {
+		in:   `foo %f`,
+		uris: []string{"file:foo/bar"},
+		err:  `"file:foo/bar" does not have an absolute file path`,
+	}, {
+		// Environment variables are not expanded.
+		in:  `foo $PATH`,
+		out: []string{"foo", "$PATH"},
+	}, {
+		// Special characters within URIs are preserved in the
+		// final command line.
+		in:   `foo %f`,
+		uris: []string{"file:///special%20chars%27%22%25%20%24foo"},
+		out:  []string{"foo", `/special chars'"% $foo`},
 	}} {
 		c.Logf("tc %d", i)