From ab62c22d640d4ca9dadf4cded5a5ed140d9bd2bb Mon Sep 17 00:00:00 2001
From: zhangkun2 <zhangkun2@uniontech.com>
Date: Fri, 30 Oct 2026 13:15:03 +0800
Subject: [PATCH] =?UTF-8?q?fix(shutdown):=20=E6=B6=88=E9=99=A4=20bash=20-c?=
 =?UTF-8?q?=20=E6=95=B4=E4=B8=B2=E6=89=A7=E8=A1=8C=EF=BC=8C=E6=94=B9?=
 =?UTF-8?q?=E4=B8=BA=E5=8F=82=E6=95=B0=E5=8C=96=20QProcess=20=E8=B0=83?=
 =?UTF-8?q?=E7=94=A8=20(CWE-78)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

将 shutdownplugin.cpp 中 break 快捷键触发的锁屏逻辑从 bash -c 整串执行
重构为独立的 argv 参数化 QProcess 调用 + QDBusMessage，消除 CWE-78
安全编码规范违规，功能逻辑不变。

Closes: DDE-516
---
 plugins/dde-dock/shutdown/shutdownplugin.cpp | 38 +++++++++++++++++++-
 plugins/dde-dock/shutdown/shutdownplugin.h   |  1 +
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/plugins/dde-dock/shutdown/shutdownplugin.cpp b/plugins/dde-dock/shutdown/shutdownplugin.cpp
index 4720b1785..9b119e8eb 100644
--- a/plugins/dde-dock/shutdown/shutdownplugin.cpp
+++ b/plugins/dde-dock/shutdown/shutdownplugin.cpp
@@ -320,7 +320,7 @@ void ShutdownPlugin::invokedMenuItem(const QString &itemKey, const QString &menu
 #endif
 
         } else {
-            QProcess::execute("bash -c \"originmap=$(setxkbmap -query | grep option | awk -F ' ' '{print $2}');/usr/bin/setxkbmap -option grab:break_actions&&/usr/bin/xdotool key XF86Ungrab&&dbus-send --print-reply --dest=org.deepin.dde.LockFront1 /org/deepin/dde/LockFront1 org.deepin.dde.LockFront1.Show&&setxkbmap -option $originmap\"");
+            lockWithBreakActions();
         }
     } else
         DDBusSender()
@@ -331,6 +331,42 @@ void ShutdownPlugin::invokedMenuItem(const QString &itemKey, const QString &menu
         .call();
 }
 
+void ShutdownPlugin::lockWithBreakActions()
+{
+    // Query current xkbmap option
+    QProcess queryProc;
+    queryProc.start("setxkbmap", {"-query"});
+    queryProc.waitForFinished();
+    QString output = QString::fromLocal8Bit(queryProc.readAllStandardOutput());
+
+    QString originmap;
+    for (const QString &line : output.split('\n')) {
+        if (line.startsWith("options:")) {
+            originmap = line.section(':', 1).trimmed();
+            break;
+        }
+    }
+
+    // Set grab:break_actions, send XF86Ungrab, then call LockFront1.Show
+    if (QProcess::execute("setxkbmap", {"-option", "grab:break_actions"}) == 0) {
+        if (QProcess::execute("xdotool", {"key", "XF86Ungrab"}) == 0) {
+            QDBusMessage msg = QDBusMessage::createMethodCall(
+                "org.deepin.dde.LockFront1",
+                "/org/deepin/dde/LockFront1",
+                "org.deepin.dde.LockFront1",
+                "Show");
+            QDBusConnection::sessionBus().call(msg);
+        }
+    }
+
+    // Restore original xkbmap option (unconditional)
+    if (originmap.isEmpty()) {
+        QProcess::execute("setxkbmap", {"-option"});
+    } else {
+        QProcess::execute("setxkbmap", {"-option", originmap});
+    }
+}
+
 void ShutdownPlugin::displayModeChanged(const Dock::DisplayMode displayMode)
 {
     Q_UNUSED(displayMode);
diff --git a/plugins/dde-dock/shutdown/shutdownplugin.h b/plugins/dde-dock/shutdown/shutdownplugin.h
index 681bf2cc7..f34949998 100644
--- a/plugins/dde-dock/shutdown/shutdownplugin.h
+++ b/plugins/dde-dock/shutdown/shutdownplugin.h
@@ -92,6 +92,7 @@ class ShutdownPlugin : public QObject, PluginsItemInterface
 private:
     void loadPlugin();
     void refreshPluginItemsVisible();
+    void lockWithBreakActions();
 
 private:
     bool m_pluginLoaded;