To test the patch you can call:
dbus-send --system --print-reply --dest=com.ubuntu.LanguageSelector / com.ubuntu.LanguageSelector.SetSystemDefaultLanguageEnv string:"abc\" EVIL_COMMAND && true \"xyz"
The old version writes LANGUAGE="abc" EVIL_COMMAND && true "xyz" to /etc/default/locale even when canceling the auth dialog.
The patched one always returns false.
To test the patch you can call: com.ubuntu. LanguageSelecto r / com.ubuntu. LanguageSelecto r.SetSystemDefa ultLanguageEnv string:"abc\" EVIL_COMMAND && true \"xyz"
dbus-send --system --print-reply --dest=
The old version writes LANGUAGE="abc" EVIL_COMMAND && true "xyz" to /etc/default/locale even when canceling the auth dialog.
The patched one always returns false.