Harden fm_shim_frontend URI and desktop-file handling

[assisted-by-ai]

Motivation

• The code previously relied on ad-hoc string slicing for file:/// URIs which is fragile and can mishandle percent-encoded or edge-case inputs.
• The control-character filtering loop was ineffective and could let invalid paths through.
• The xdg-mime output was used without validating it as a simple .desktop filename, risking malformed or attacker-controlled values being used as paths.

Description

• Added urllib.parse.urlsplit and unquote to robustly parse and decode incoming URIs.
• Restricted accepted URIs to local file: URLs by checking scheme and allowing only empty or localhost netloc.
• Reject decoded paths that contain control characters before converting to Path and before any filesystem checks.
• Validate the xdg-mime result to ensure it is a non-empty plain filename that does not contain / and ends with .desktop before constructing a path to the desktop file.
• Changes applied to usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py.

Testing

• Ran python3 -m py_compile usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py which completed successfully.

---

Codex Task

[assisted-by-ai]

Summary
Yes — there were input-validation weaknesses that could be abused:

URI parsing previously relied on string prefix/slicing (file:///...) rather than proper URL parsing, which is fragile for encoded/edge-case inputs.

The control-character filter loop was ineffective (it never rejected bad characters).

The default file manager .desktop value from xdg-mime was not validated as a filename before path construction.
These are now fixed.

Security hardening changes made:

Added robust URI parsing/decoding with urlsplit + unquote.

Restricted accepted URIs to local file: URLs only (netloc is "" or "localhost").

Properly reject decoded paths containing control characters.

Added strict validation for xdg-mime result (non-empty, no /, must end with .desktop).

I committed the fix on the current branch: e533ddb7.

I also created the PR message via the make_pr tool as requested.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 99b74d7fe4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject empty or relative file URI paths

The new urlsplit-based parsing accepts any file: URI with empty/localhost authority, but it never validates that uri_components.path is absolute before Path(path_str) is constructed. Inputs like file://localhost (empty path) and file:tmp (relative path) now resolve to Path('')/Path('tmp'), which are interpreted relative to the process working directory and can cause the shim to prompt/open unintended directories; previously these were rejected by the strict file:/// prefix check.

Useful? React with 👍 / 👎.