Fixes in "printers@cinnamon.org"

[hans-fritz-pommes]

I encountered several small issues with the printers applet.
I modified the applet.js in /usr/share/cinnamon/applets/printers@cinnamon.org and tested printing documents.
The things I did correct:

• The "Cancel all jobs" command didn't work for an user who had no permisisons to run cancel -a for a specific printer, even if all of the jobs on this printer belonged to him.
  -> Now the "Cancel all jobs" command tries to cancel every single job, not cancel -a for every printer
• The appearance of the listed jobs was really bad: e.g. when you had more than one job, the description for every job was "<desc. first job><desc. second job><desc..." and so on.
• The job description consisted of: (job number) lpstat -o (lpstat several times, if there was more than one job - see point before)
  -> The description is now: (job number) 'document_name' on <printer_name> (<size in Bytes/MB/KB>) by <user> (using lpq -a).

The following problem could occur:
If a job has the same number as byte-size like the job-id of the following one, the username and the filesize of the first one will be strange (job-id and functions stay working).
I would say this will happen that seldom - we should ignore it.
Which user will open the menu exactly in that minute and have a problem with a strange username or filesize?

EDIT: fixed in new commit

[hans-fritz-pommes]

Oh and I changed icons. If you think they're ugly, just revert it

[hans-fritz-pommes]

I have an idea how to fix this mini-problem (identical bytes & job-number). But later

[hans-fritz-pommes]

Ok, now the identical bytes/document-name & job-number-problem is fixed.

[hans-fritz-pommes]

Sorry that I'm so chaotic
I forgot to take care of document names with whitespaces

[github-actions]

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

---

Found 1 potential issue(s):

⚠️ lang_bind

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:218

Util.spawn_async(['/usr/bin/lpq', '-a'], Lang.bind(this, function(out2) {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

---

Automated pattern check.

[github-actions]

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

---

Found 1 potential issue(s):

⚠️ lang_bind

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:203

Util.spawn_async(['/usr/bin/lpq', '-a'], Lang.bind(this, function(out2) {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

---

Automated pattern check.

[hans-fritz-pommes]

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or maintainability issues, or that may already be provided by Cinnamon. Having code flagged by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

Found 1 potential issue(s):

⚠️ lang_bind

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:218

Util.spawn_async(['/usr/bin/lpq', '-a'], Lang.bind(this, function(out2) {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

Automated pattern check.

What should be done with that?

[leigh123linux]

Please squash the commits into one.

[mtwebster]

What should be done with that?

What it suggests - use an arrow function instead of using Lang.bind(). Look at other applets, it's a pretty straightforward change.

[hans-fritz-pommes]

By the way:
I was wondering why ever lpstat was used for gathering the job-data.
This pull request removed lpq. I thought every system having lpstat also has lpq since it's a part of cups?

[hans-fritz-pommes]

Those new commits intend to make it compatible with a turned-off CUPS-service

[hans-fritz-pommes]

Please squash the commits into one.

I will do that when merging

🤦oups merging is not my task, right?

[hans-fritz-pommes]

Now the guy from #13039 shouldn't have problems anymore with missing lpq and there shouldn't be a problem with missing / not running cups (#9265).

[mtwebster]

Can we drop the python script? util.spawnCommandLineAsyncIO() should work fine in this case - they're all fixed arguments. Sorry I should have caught this earlier...

[github-actions]

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

---

Found 5 potential issue(s):

ℹ️ shell_string_spawn

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:181

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -a', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:192

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -l', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:214

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -d', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:242

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -o', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:265

Util.spawnCommandLineAsyncIO('/usr/bin/lpq -a', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

---

Automated pattern check.

[github-actions]

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

---

Found 5 potential issue(s):

ℹ️ shell_string_spawn

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:181

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -a', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:192

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -l', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:214

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -d', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:242

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -o', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:265

Util.spawnCommandLineAsyncIO('/usr/bin/lpq -a', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

---

Automated pattern check.

[github-actions]

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

---

Found 5 potential issue(s):

ℹ️ shell_string_spawn

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:181

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -a', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:192

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -l', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:214

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -d', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:242

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -o', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:265

Util.spawnCommandLineAsyncIO('/usr/bin/lpq -a', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

---

Automated pattern check.

[hans-fritz-pommes]

Can we drop the python script? util.spawnCommandLineAsyncIO() should work fine in this case - they're all fixed arguments. Sorry I should have caught this earlier...

Why would it be insecure if there were user inputs?
And why is there no function with argv and the possibility to catch stdout, stderr and exitCode?

(It's just about understanding)

[hans-fritz-pommes]

Ah and I replaced the second python script - this means now we don't have Gtk-dialogs anymore. Instead: A Cinnamon modal dialog.

[mtwebster]

Why would it be insecure if there were user inputs?

You can get a lot more info with Google or asking AI to explain shell injection vulnerabilities... but basically,

This is safe - it will always run exactly that command, you're using a static string.

Util.spawnCommandLineAsyncIO('/usr/bin/lpq -a', ()=>{});

but, for example filename restrictions are fairly lax...

let file = file.get_basename() // '; dangerous-command ~'
let cmd = "ls -la " + file;
Util.spawnCommandLineAsyncIO(file, ()=>{}); // ls -la ; dangerous-command ~

That example is pretty extreme and unlikely, but it's a real concern, and we're all better off being in the habit of using argv variants in the first place, to prevent misinterpretation like this.

And why is there no function with argv and the possibility to catch stdout, stderr and exitCode?

Because I didn't notice it was missing before implementing our pattern checker here - I'll be adding one for sure. You could use GLib.spawn_async_with_pipes or Gio.Subprocess api directly (which is what spawnCommandLineAsyncIO uses internally), but they're much less convenient to setup and use. For your purposes here, it's ok.

[github-actions]

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

---

Found 5 potential issue(s):

ℹ️ shell_string_spawn

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:180

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -a', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:191

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -l', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:213

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -d', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:241

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -o', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:264

Util.spawnCommandLineAsyncIO('/usr/bin/lpq -a', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

---

Automated pattern check.

[hans-fritz-pommes]

Should I port to spawnAsyncIO or just leave it?

[github-actions]

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

---

Found 5 potential issue(s):

ℹ️ shell_string_spawn

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:180

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -a', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:191

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -l', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:213

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -d', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:241

Util.spawnCommandLineAsyncIO('/usr/bin/lpstat -o', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

files/usr/share/cinnamon/applets/printers@cinnamon.org/applet.js:264

Util.spawnCommandLineAsyncIO('/usr/bin/lpq -a', (stdout, stderr, exitCode) => {

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

---

Automated pattern check.

[hans-fritz-pommes]

oups - not intentionally updated my fork