Revert removal of placeholder resolving for commands

* Fix UUID being built improperly with invalid user input
keepassxreboot · Jul 11, 2018 · a5aaa42 · a5aaa42
1 parent a94de0e
commit a5aaa42
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 5 deletions.
diff --git a/src/core/Uuid.cpp b/src/core/Uuid.cpp
@@ -88,13 +88,19 @@ bool Uuid::operator!=(const Uuid& other) const
 Uuid Uuid::fromBase64(const QString& str)
 {
     QByteArray data = QByteArray::fromBase64(str.toLatin1());
-    return Uuid(data);
+    if (data.size() == Uuid::Length) {
+        return Uuid(data);
+    }
+    return {};
 }
 
 Uuid Uuid::fromHex(const QString& str)
 {
     QByteArray data = QByteArray::fromHex(str.toLatin1());
-    return Uuid(data);
+    if (data.size() == Uuid::Length) {
+        return Uuid(data);
+    }
+    return {};
 }
 
 uint qHash(const Uuid& key)

diff --git a/src/gui/DatabaseWidget.cpp b/src/gui/DatabaseWidget.cpp
@@ -633,8 +633,8 @@ void DatabaseWidget::openUrl()
 
 void DatabaseWidget::openUrlForEntry(Entry* entry)
 {
-    if (entry->url().startsWith("cmd://")) {
-        QString cmdString = entry->resolveMultiplePlaceholders(entry->url());
+    QString cmdString = entry->resolveMultiplePlaceholders(entry->url());
+    if (cmdString.startsWith("cmd://")) {
         // check if decision to execute command was stored
         if (entry->attributes()->hasKey(EntryAttributes::RememberCmdExecAttr)) {
             if (entry->attributes()->value(EntryAttributes::RememberCmdExecAttr) == "1") {
@@ -646,8 +646,9 @@ void DatabaseWidget::openUrlForEntry(Entry* entry)
         // otherwise ask user
         if (cmdString.length() > 6) {
             QString cmdTruncated = cmdString.mid(6);
-            if (cmdTruncated.length() > 400)
+            if (cmdTruncated.length() > 400) {
                 cmdTruncated = cmdTruncated.left(400) + " […]";
+            }
             QMessageBox msgbox(QMessageBox::Icon::Question,
                                tr("Execute command?"),
                                tr("Do you really want to execute the following command?<br><br>%1<br>")