Re: [bug-buddy]: Custom scripts for your application

[Brian Cameron <Brian Cameron Sun COM>]

Fernando:

It sounds like a cool idea, but I always worry about code that
"automagically" runs code in the background without the user being
aware of what is goind on.  Especially when desktop files can
be added to the system by installing random packages found on the
internet.

Isn't it possible to install .desktop files in the user's $HOME
directory?  If someone were to trick a user into installing a
.desktop file with a script that does something malicious, is there
anything to protect the user from the malicious thing happening the
next time the program corresponding to the desktop file crashes?

Since .desktop files can be shipped by 3rd parties, is there any
privacy issues about collecting information and forwarding it along
to a bug database.  For example, core files might contain passwords,
so might not be appropriate to forward as an attachment to a public
database.  Will there be any way for the end user to control what
sorts of data can be collected and forwarded with a bug report?

Will it be possible for people concerned about the security or
privacy ramifications to be able to turn off the feature if they
don't want scripts running in the background?  Will a pop-up be
displayed asking the user if they want to send the report with
some explination that scripts may be run in the background.

Brian

> Hi, after reading Feredico's mail[1] I added that feature to bug-buddy.
>
> Now if you add to your application .dektop file the field:
>  X-GNOME-Bugzilla-ExtraInfoScript=myscript
>
> that script will be executed during bug-buddy info collecting and its
> output will be appended to the report.
>
> For applets you need to use the field:
> bugzilla:extra_info_script
>
> I implemented it using g_spawn_command_line_sync, because most of
> scripts are supposed just to cat some log/info/configuration files. If
> people begin to add time consuming scripts I should move it to the
> async version.
>
> Enjoy!
>
> Salu2
>
> [1] http://mail.gnome.org/archives/desktop-devel-list/2006-November/msg00148.html