fix: escape comment author markup and validate Group script arguments

src/Group.py

@@ -6,24 +6,64 @@
 @author: fatih
 """
 
+import os
+import pwd
+import re
+import shutil
 import subprocess
 import sys
 
+USERNAME_REGEX = re.compile(r"^[a-zA-Z0-9_.][a-zA-Z0-9_.-]*\$?$")
+
+
+def validate_username(username):
+    if not username or not USERNAME_REGEX.match(username):
+        sys.stderr.write(f"Error: Invalid username format: '{username}'.\n")
+        return False
+    try:
+        pwd.getpwnam(username)
+        return True
+    except KeyError:
+        sys.stderr.write(f"Error: User '{username}' does not exist.\n")
+        return False
+
 
 def main():
-    def addtogroup(user):
-        subprocess.call(["adduser", user, "pardus-software"])
+    if len(sys.argv) < 3:
+        sys.stderr.write("Usage: Group.py <add|del> <username>\n")
+        sys.exit(1)
+
+    action = sys.argv[1]
+    user = sys.argv[2]
+
+    if not validate_username(user):
+        sys.exit(1)
 
-    def delfromgroup(user):
-        subprocess.call(["deluser", user, "pardus-software"])
+    target_group = "pardus-software"
 
-    if len(sys.argv) > 1:
-        if sys.argv[1] == "add":
-            addtogroup(sys.argv[2])
-        elif sys.argv[1] == "del":
-            delfromgroup(sys.argv[2])
+    if action == "add":
+        cmd_name = "adduser"
+        cmd_path = shutil.which(cmd_name) or (
+            f"/usr/sbin/{cmd_name}" if os.path.exists(f"/usr/sbin/{cmd_name}") else None
+        )
+        if not cmd_path:
+            sys.stderr.write(f"Error: Command '{cmd_name}' not found on system.\n")
+            sys.exit(1)
+        rc = subprocess.call([cmd_path, user, target_group])
+        sys.exit(rc)
+    elif action == "del":
+        cmd_name = "deluser"
+        cmd_path = shutil.which(cmd_name) or (
+            f"/usr/sbin/{cmd_name}" if os.path.exists(f"/usr/sbin/{cmd_name}") else None
+        )
+        if not cmd_path:
+            sys.stderr.write(f"Error: Command '{cmd_name}' not found on system.\n")
+            sys.exit(1)
+        rc = subprocess.call([cmd_path, user, target_group])
+        sys.exit(rc)
     else:
-        print("no argument passed")
+        sys.stderr.write(f"Error: Unknown action '{action}'. Valid actions are 'add' or 'del'.\n")
+        sys.exit(1)
 
 
 if __name__ == "__main__":

src/MainWindow.py

@@ -3652,7 +3652,7 @@ def create_comment_widget(self, comment, gnome=False):
             comment = "{}\n{}".format(comment["summary"], comment["description"])
 
         label_author = Gtk.Label.new()
-        label_author.set_markup("<b>{}</b>".format(author))
+        label_author.set_markup("<b>{}</b>".format(GLib.markup_escape_text(str(author), -1)))
         label_author.set_selectable(True)
 
         label_date = Gtk.Label.new()
@@ -3693,11 +3693,11 @@ def create_comment_widget(self, comment, gnome=False):
         label_comment.set_xalign = 0.0
 
         label_distro = Gtk.Label.new()
-        label_distro.set_markup("{}".format(distro))
+        label_distro.set_text("{}".format(distro))
         label_distro.set_selectable(True)
 
         label_appversion = Gtk.Label.new()
-        label_appversion.set_markup("{}: {}".format(_("App"), app_version))
+        label_appversion.set_markup("{}: {}".format(_("App"), GLib.markup_escape_text(str(app_version), -1)))
         label_appversion.set_selectable(True)
 
         box_bottom = Gtk.Box.new(Gtk.Orientation.HORIZONTAL, 8)
@@ -5076,7 +5076,10 @@ def on_group_process_exit(self, pid, status):
         self.control_groups()
         if status != 0:
             self.ui_settings_password_info_label.set_markup(
-                "<small><span color='red' weight='light'>{}</span></small>".format(self.grouperrormessage))
+                "<small><span color='red' weight='light'>{}</span></small>".format(
+                    GLib.markup_escape_text(str(self.grouperrormessage), -1)
+                )
+            )
         else:
             self.ui_settings_password_info_label.set_text("")