[mhduiy]

修复说明

将 shutdownplugin.cpp 中 break 快捷键触发的锁屏逻辑从 bash -c 整串执行重构为独立的 argv 参数化 QProcess 调用，消除 CWE-78 安全编码规范违规，功能逻辑不变。

变更内容

1. plugins/dde-dock/shutdown/shutdownplugin.h：新增私有方法声明 void lockWithBreakActions();
2. plugins/dde-dock/shutdown/shutdownplugin.cpp：
   • 将 QProcess::execute("bash -c ...") 整串执行替换为 lockWithBreakActions() 方法调用
   • 新增 lockWithBreakActions() 方法实现，逻辑拆分为独立的 argv 参数化调用：
     1. 查询当前 xkbmap option：QProcess::start("setxkbmap", {"-query"}) 捕获 stdout，在代码内解析 options: 行获取 originmap 值
     2. 设置 grab:break_actions：QProcess::execute("setxkbmap", {"-option", "grab:break_actions"})
     3. 发送 XF86Ungrab：QProcess::execute("xdotool", {"key", "XF86Ungrab"})
     4. 调用 LockFront1.Show：用 QDBusMessage::createMethodCall(...) + QDBusConnection::sessionBus().call(msg) 替代 dbus-send
     5. 恢复原始 xkbmap option：无条件执行，确保键盘状态始终恢复

步骤 2-4 使用嵌套 if (execute(...) == 0) 维持原 && 串行时序；步骤 5 放在嵌套 if 之外无条件执行。

安全性

CWE-78 OS 命令注入（编码规范）已有效消除，不再使用 bash -c 整串执行。

关联 Issue

DDE-516

Summary by Sourcery

Replace shell-string execution in the break-action lock flow with safe parameterized commands while preserving behavior and keyboard state restoration.

Bug Fixes:

• Eliminate the shutdown plugin’s CWE-78 command-injection risk by replacing shell-based lock-screen execution with parameterized process and D-Bus calls.

Enhancements:

• Preserve the break-action lock flow while ensuring the original keyboard mapping option is restored regardless of intermediate command failures.

[deepin-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[sourcery-ai]

Reviewer's Guide

本 PR 将 break 快捷键触发的锁屏逻辑封装为独立方法，移除 bash -c 拼接命令，改用参数化 QProcess 和原生 D-Bus 调用；同时保留原有执行顺序，并确保无论中间步骤是否成功都会恢复键盘映射选项，从而消除 CWE-78 命令注入风险。

Sequence diagram for parameterized break-action locking

sequenceDiagram
    participant ShutdownPlugin
    participant QProcess
    participant XKB as setxkbmap
    participant Xdotool as xdotool
    participant LockFront1

    ShutdownPlugin->>ShutdownPlugin: lockWithBreakActions()
    ShutdownPlugin->>QProcess: start("setxkbmap", ["-query"])
    QProcess->>XKB: execute -query
    XKB-->>QProcess: stdout
    QProcess-->>ShutdownPlugin: readAllStandardOutput()
    ShutdownPlugin->>QProcess: execute("setxkbmap", ["-option", "grab:break_actions"])
    QProcess->>XKB: set grab:break_actions
    XKB-->>QProcess: exit code 0
    ShutdownPlugin->>QProcess: execute("xdotool", ["key", "XF86Ungrab"])
    QProcess->>Xdotool: send XF86Ungrab
    Xdotool-->>QProcess: exit code 0
    ShutdownPlugin->>LockFront1: Show()
    LockFront1-->>ShutdownPlugin: reply
    ShutdownPlugin->>QProcess: execute("setxkbmap", ["-option", originmap])
    QProcess->>XKB: restore original option

Loading

File-Level Changes

Change	Details	Files
将 break 快捷键锁屏流程从 shell 字符串执行重构为参数化的独立进程与 D-Bus 调用，并集中封装到新方法中。	新增私有 lockWithBreakActions() 方法并替换原快捷键分支调用。 通过 QProcess 启动 setxkbmap -query，并在 C++ 中解析当前 options。 使用 argv 参数化执行 setxkbmap 和 xdotool，按原有成功条件维持串行流程。 使用 QDBusMessage/QDBusConnection session bus 调用 LockFront1.Show，移除 dbus-send。 将原始 xkbmap option 的恢复移至流程外，无条件执行。	plugins/dde-dock/shutdown/shutdownplugin.cpp plugins/dde-dock/shutdown/shutdownplugin.h

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: 18202781743, mhduiy

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment