fix(launcher): avoid appimage origin from path shadowing

#3975

Author: Ly-sec

src/system/desktop_entry.cpp

@@ -26,6 +26,22 @@ namespace {
 
   constexpr Logger kLog("desktop_entry");
 
+  bool isUserDesktopEntry(const fs::path& filepath) {
+    fs::path dataHome;
+    if (const char* configured = std::getenv("XDG_DATA_HOME"); configured != nullptr && configured[0] != '\0') {
+      dataHome = configured;
+    } else if (const char* home = std::getenv("HOME"); home != nullptr && home[0] != '\0') {
+      dataHome = fs::path(home) / ".local/share";
+    } else {
+      return false;
+    }
+
+    const fs::path applications = (dataHome / "applications").lexically_normal();
+    const fs::path normalized = filepath.lexically_normal();
+    const auto mismatch = std::ranges::mismatch(applications, normalized);
+    return mismatch.in1 == applications.end();
+  }
+
   fs::path resolveExecutable(std::string_view executable) {
     const fs::path path(executable);
     if (path.has_parent_path()) {
@@ -56,7 +72,7 @@ namespace {
     return {};
   }
 
-  bool executableIsAppImage(std::string_view exec) {
+  bool executableIsAppImage(std::string_view exec, bool resolveFromPath) {
     const auto start = exec.find_first_not_of(' ');
     if (start == std::string_view::npos) {
       return false;
@@ -74,7 +90,10 @@ namespace {
       return true;
     }
 
-    std::ifstream file(resolveExecutable(executable.string()), std::ios::binary);
+    const fs::path resolved = executable.has_parent_path()
+        ? executable
+        : (resolveFromPath ? resolveExecutable(executable.string()) : fs::path{});
+    std::ifstream file(resolved, std::ios::binary);
     std::array<char, 10> header{};
     if (!file.read(header.data(), static_cast<std::streamsize>(header.size()))) {
       return false;
@@ -419,7 +438,8 @@ namespace {
     entry.startupWmClassLower = StringUtils::toLower(entry.startupWmClass);
     entry.idLower = StringUtils::toLower(entry.id);
     entry.execLower = StringUtils::toLower(entry.exec);
-    entry.origin = detectOrigin(filepath, hasAppImageMetadata || executableIsAppImage(entry.exec));
+    entry.origin =
+        detectOrigin(filepath, hasAppImageMetadata || executableIsAppImage(entry.exec, isUserDesktopEntry(filepath)));
 
     // Build actions in the declared order.
     for (const auto& id : actionOrder) {

tests/app_identity_test.cpp

@@ -96,10 +96,12 @@ namespace {
 
     const fs::path root = fs::temp_directory_path() / ("noctalia-appimage-origin-" + std::to_string(getpid()));
     const fs::path applications = root / "data/applications";
+    const fs::path systemApplications = root / "system/applications";
     const fs::path executable = root / "PortableApp";
     const fs::path bin = root / "bin";
     const fs::path workingDirectory = root / "cwd";
     fs::create_directories(applications);
+    fs::create_directories(systemApplications);
     fs::create_directories(bin);
     fs::create_directories(workingDirectory);
     {
@@ -131,6 +133,7 @@ namespace {
       binary << "#!/bin/sh\nexit 0\n";
       chmod((bin / "native-app").c_str(), 0700);
       fs::create_symlink(executable, bin / "path-appimage");
+      fs::create_symlink(executable, bin / "shadowed-native");
       fs::create_symlink(executable, workingDirectory / "native-app");
     }
     {
@@ -141,6 +144,10 @@ namespace {
       std::ofstream entry(applications / "path.desktop");
       entry << "[Desktop Entry]\nType=Application\nName=PATH AppImage\nExec=path-appimage\n";
     }
+    {
+      std::ofstream entry(systemApplications / "shadowed-native.desktop");
+      entry << "[Desktop Entry]\nType=Application\nName=Shadowed Native App\nExec=shadowed-native\n";
+    }
 
     const char* oldDataHome = std::getenv("XDG_DATA_HOME");
     const char* oldDataDirs = std::getenv("XDG_DATA_DIRS");
@@ -153,7 +160,7 @@ namespace {
         oldPath == nullptr ? std::nullopt : std::optional<std::string>(oldPath);
     const fs::path savedWorkingDirectory = fs::current_path();
     setenv("XDG_DATA_HOME", (root / "data").c_str(), 1);
-    setenv("XDG_DATA_DIRS", (root / "empty").c_str(), 1);
+    setenv("XDG_DATA_DIRS", (root / "system").c_str(), 1);
     setenv("PATH", bin.c_str(), 1);
     fs::current_path(workingDirectory);
 
@@ -167,6 +174,7 @@ namespace {
     TEST_CHECK(findOrigin("suffix") == DesktopEntryOrigin::AppImage);
     TEST_CHECK(findOrigin("native") == DesktopEntryOrigin::System);
     TEST_CHECK(findOrigin("path") == DesktopEntryOrigin::AppImage);
+    TEST_CHECK(findOrigin("shadowed-native") == DesktopEntryOrigin::System);
 
     fs::current_path(savedWorkingDirectory);