Comment 2 for bug 1998538

Revision history for this message
James Henstridge (jamesh) wrote :

The code in question was removed as it enabled a sandbox escape, as described in bug 1880085 and CVE-2020-11934. Adding paths controlled by the snap to XDG_DATA_DIRS makes it possible to override desktop files and mime associations.

The proof of concept vulnerability on that bug happens to exploit the help: URI scheme, so even limiting the XDG_DATA_DIRS change to that scheme would be a problem.