Privacy concern related to bundling together "commands" and "URLs"

Context: Custom Shortcuts, Edit, New, Global Shortcut, Command/URL

In the “Action” tab, enter a quoted path such as "/this is a private, internal path full of personal information/".

Now, when you press the key, instead of executing the command, it opens the default web browser and sends the entire string over the Internet to a third party and performs a web search with that full string as the search query. In my case, this was DuckDuckGo. Not sure if this specifically is Plasma or my browser.

I’ve done my utmost to try to prevent such data leak events from occurring. The point is that it opens a browser and sends my command to it as an argument as if it were a URL.

Same result if single quotes are used. Even if you add more stuff after the command, the entire command string is sent as a search query, for example:

"/this is a private, internal path full of personal information/" 123 "and another highly sensitive argument here"

If I enter a command such as php "/whatever path/test.php", it correctly runs that as a command instead of sending it to my browser as a URL argument, so it seems to assume that anything that begins quoted must be a URL. This is “not good” for obvious privacy reasons. Now I have to forever think about some third party knowing about my project’s internal name and paths. While a relatively “minor” issue, it’s nevertheless very frustrating and could’ve easily been avoided.

Suggestion: Make “command” and “URL” separate entries, so that this can never happen unless it’s actually the user’s fault.

As it stands currently, it’s determined by some unknown logic. As far as I know, you’re supposed to be able to quote commands like I did and have them execute on the terminal. For example, a full path to a .sh script.

When you create a “Link,” you have to make sure you choose the right type.

Link to Location or URL
Link to File or Directory
Link to Application

To start out, just Right-Click your desktop and go to “Create New.” When the sub-menu pops up, look at the bottom for the three choices I listed above and try creating each one. Look at the properties for each of them. Open each of the .desktop files in Kate and study how they are done. It’s a good learning experience.

Are you referring to the old, no longer existing Custom Shortcuts page?


I’m not the OP, but the page still exists for me in Plasma 5.27.10.

What @Herzenschein is getting at is that the page in question is quite old and deprecated. It’s been fully removed in Plasma 6. So from that perspective, the problem will no longer be possible to happen. :slight_smile:

I do agree that making a web search for this is not appropriate. This does not happen in the equivalent feature in the newer, supported, successor page (System Settings > Shortcuts > Shortcuts).