Code Quality: Isolate Windows-only actions and shell UX (P4-H)

docs/linux-port/threat-model-launching.md

@@ -19,6 +19,7 @@ Attacker: controls a file's name, content, mode bits and symlinks (downloaded ar
 | 9 | Defense in depth inside the launcher: `OpenAsync` refuses executable MIME types (x-executable, x-pie-executable, x-sharedlib, appimage, x-desktop); no xdg-open fallback for files with an execute bit (also via symlink); `LaunchUriAsync` refuses `file:` URIs | `LinuxLauncherService` | `Open_ExecutableMimeTypes...`, `Open_ExecBit...`, `LaunchUri_RefusesFileUris` |
 | 10 | More than 5 files opened at once asks first; files needing a gate are processed one by one, never in the bulk default-app launch | `OpenFilesLinuxAsync` | (UI path, covered by 1-9) |
 | 11 | Dry-run seam (`FILES_LAUNCH_DRYRUN`) so automated runs spawn nothing | `DryRunProcessStarter` | n/a |
+| 12 | Drop items onto an executable: same plan as gates 1-2 (only confirmable binaries/scripts); the dialog shows the full argv (target plus every dropped path, `DisplaySanitizer.FullArguments`, refused if too large) and exactly that argv is run after the identity re-check | `NavigationHelpers.RunWithItemsLinuxAsync` | `OnlyConfirmedActionsMayRunAFile`, `DisplaySanitizerTests` |
 
 ## Review of default-open paths that could execute
 

src/Files.App/Actions/Content/Install/InstallCertificateAction.Windows.cs

@@ -0,0 +1,15 @@
+// Copyright (c) Files Community
+// Licensed under the MIT License.
+
+using Files.Shared.Helpers;
+
+namespace Files.App.Actions
+{
+	internal sealed partial class InstallCertificateAction : ObservableObject, IAction
+	{
+		public async Task ExecuteAsync(object? parameter = null)
+		{
+			await ContextMenu.InvokeVerb("add", context.SelectedItems.Select(x => x.ItemPath).ToArray());
+		}
+	}
+}

src/Files.App/Actions/Content/Install/InstallCertificateAction.cs

@@ -36,10 +36,11 @@ public InstallCertificateAction()
 			context.PropertyChanged += Context_PropertyChanged;
 		}
 
-		public async Task ExecuteAsync(object? parameter = null)
-		{
-			await ContextMenu.InvokeVerb("add", context.SelectedItems.Select(x => x.ItemPath).ToArray());
-		}
+#if !WINDOWS
+		// LINUX-TODO(install): this Windows command is hidden on Linux.
+		public Task ExecuteAsync(object? parameter = null)
+			=> Task.CompletedTask;
+#endif
 
 		private void Context_PropertyChanged(object? sender, PropertyChangedEventArgs e)
 		{

src/Files.App/Actions/Content/Install/InstallFontAction.cs

@@ -49,10 +49,11 @@ public async Task ExecuteAsync(object? parameter = null)
 			var paths = context.SelectedItems.Select(item => item.ItemPath!).ToArray();
 			var outcome = ReturnResult.Success;
 			var installed = (long)context.SelectedItems.Count;
-			if (OperatingSystem.IsWindows())
-				await Win32Helper.InstallFontsAsync(paths, false);
-			else
-				(outcome, installed) = await InstallForCurrentUserAsync(paths);
+#if WINDOWS
+			await Win32Helper.InstallFontsAsync(paths, false);
+#else
+			(outcome, installed) = await InstallForCurrentUserAsync(paths);
+#endif
 
 			StatusCenterViewModel.RemoveItem(banner);
 			var currentWorkingDirectory = context.ShellPage.GetRequiredShellViewModel().WorkingDirectory!;

src/Files.App/Actions/Content/Install/InstallInfDriverAction.Windows.cs

@@ -0,0 +1,15 @@
+// Copyright (c) Files Community
+// Licensed under the MIT License.
+
+using Files.Shared.Helpers;
+
+namespace Files.App.Actions
+{
+	internal sealed partial class InstallInfDriverAction : ObservableObject, IAction
+	{
+		public async Task ExecuteAsync(object? parameter = null)
+		{
+			await Task.WhenAll(context.SelectedItems.Select(selectedItem => Win32Helper.InstallInf(selectedItem.ItemPath)));
+		}
+	}
+}

src/Files.App/Actions/Content/Install/InstallInfDriverAction.cs

@@ -36,10 +36,11 @@ public InstallInfDriverAction()
 			context.PropertyChanged += Context_PropertyChanged;
 		}
 
-		public async Task ExecuteAsync(object? parameter = null)
-		{
-			await Task.WhenAll(context.SelectedItems.Select(selectedItem => Win32Helper.InstallInf(selectedItem.ItemPath)));
-		}
+#if !WINDOWS
+		// LINUX-TODO(install): this Windows command is hidden on Linux.
+		public Task ExecuteAsync(object? parameter = null)
+			=> Task.CompletedTask;
+#endif
 
 		public void Context_PropertyChanged(object? sender, System.ComponentModel.PropertyChangedEventArgs e)
 		{

src/Files.App/Actions/Content/Run/BaseRunAsAction.Windows.cs

@@ -0,0 +1,15 @@
+// Copyright (c) Files Community
+// Licensed under the MIT License.
+
+
+
+namespace Files.App.Actions
+{
+	internal abstract partial class BaseRunAsAction : ObservableObject, IAction
+	{
+		public async Task ExecuteAsync(object? parameter = null)
+		{
+			await ContextMenu.InvokeVerb(_verb, _context.SelectedItem!.ItemPath);
+		}
+	}
+}

src/Files.App/Actions/Content/Run/BaseRunAsAction.cs

@@ -3,7 +3,7 @@
 
 namespace Files.App.Actions
 {
-	internal abstract class BaseRunAsAction : ObservableObject, IAction
+	internal abstract partial class BaseRunAsAction : ObservableObject, IAction
 	{
 		private readonly IContentPageContext _context;
 
@@ -28,10 +28,11 @@ public BaseRunAsAction(string verb)
 			_context.PropertyChanged += Context_PropertyChanged;
 		}
 
-		public async Task ExecuteAsync(object? parameter = null)
-		{
-			await ContextMenu.InvokeVerb(_verb, _context.SelectedItem!.ItemPath);
-		}
+#if !WINDOWS
+		// LINUX-TODO(launching): Windows shell elevation verbs are hidden on Linux.
+		public Task ExecuteAsync(object? parameter = null)
+			=> Task.CompletedTask;
+#endif
 
 		public void Context_PropertyChanged(object? sender, PropertyChangedEventArgs e)
 		{

src/Files.App/Actions/Content/Run/RunWithPowershellAction.Windows.cs

@@ -0,0 +1,20 @@
+// Copyright (c) Files Community
+// Licensed under the MIT License.
+
+using Files.Shared.Helpers;
+
+namespace Files.App.Actions
+{
+	internal sealed partial class RunWithPowershellAction : ObservableObject, IAction
+	{
+		public Task ExecuteAsync(object? parameter = null)
+		{
+			var itemPath = context.ShellPage?.SlimContentPage?.SelectedItem?.ItemPath;
+			return Win32Helper.RunPowershellCommandAsync(
+				$"& {Win32Helper.ToPowerShellStringLiteral(itemPath)}",
+				PowerShellExecutionOptions.None,
+				context.Folder?.ItemPath
+			);
+		}
+	}
+}

src/Files.App/Actions/Content/Run/RunWithPowershellAction.cs

@@ -35,15 +35,11 @@ public RunWithPowershellAction()
 			context.PropertyChanged += Context_PropertyChanged;
 		}
 
+#if !WINDOWS
+		// LINUX-TODO(launching): this Windows command is hidden on Linux.
 		public Task ExecuteAsync(object? parameter = null)
-		{
-			var itemPath = context.ShellPage?.SlimContentPage?.SelectedItem?.ItemPath;
-			return Win32Helper.RunPowershellCommandAsync(
-				$"& {Win32Helper.ToPowerShellStringLiteral(itemPath)}",
-				PowerShellExecutionOptions.None,
-				context.Folder?.ItemPath
-			);
-		}
+			=> Task.CompletedTask;
+#endif
 
 		private void Context_PropertyChanged(object? sender, PropertyChangedEventArgs e)
 		{

src/Files.App/Actions/Content/Share/ShareItemAction.cs

@@ -29,6 +29,7 @@ public string AccessKey
 			=> "H";
 
 		public bool IsExecutable =>
+			OperatingSystem.IsWindows() &&
 			IsContextPageTypeAdaptedToCommand() &&
 			ShareItemHelpers.IsSupported() &&
 			context.SelectedItems.Any() &&
@@ -43,6 +44,9 @@ public ShareItemAction()
 
 		public Task ExecuteAsync(object? parameter = null)
 		{
+			if (!IsExecutable)
+				return Task.CompletedTask;
+
 			return ShareItemHelpers.ShareItemsAsync(context.SelectedItems);
 		}
 

src/Files.App/Actions/FileSystem/CreateAlternateDataStreamAction.Windows.cs

@@ -0,0 +1,83 @@
+// Copyright (c) Files Community
+// Licensed under the MIT License.
+
+using Microsoft.UI.Xaml.Controls;
+using Windows.Foundation.Metadata;
+
+namespace Files.App.Actions
+{
+	internal sealed partial class CreateAlternateDataStreamAction : BaseUIAction, IAction
+	{
+		public async Task ExecuteAsync(object? parameter = null)
+		{
+			var nameDialog = DynamicDialogFactory.GetFor_CreateAlternateDataStreamDialog();
+			await nameDialog.TryShowAsync();
+
+			if (nameDialog.DynamicResult != DynamicDialogResult.Primary)
+				return;
+
+			var userInput = nameDialog.ViewModel.AdditionalData as string;
+			await Task.WhenAll(context.SelectedItems.Select(async selectedItem =>
+			{
+				var itemPath = selectedItem.ItemPath!;
+				var isDateOk = Win32Helper.GetFileDateModified(itemPath, out var dateModified);
+				var isReadOnly = Win32Helper.HasFileAttribute(itemPath, System.IO.FileAttributes.ReadOnly);
+
+				// Unset read-only attribute (#7534)
+				if (isReadOnly)
+					Win32Helper.UnsetFileAttribute(itemPath, System.IO.FileAttributes.ReadOnly);
+
+				if (!Win32Helper.WriteStringToFile($"{itemPath}:{userInput}", ""))
+				{
+					var dialog = new ContentDialog
+					{
+						Title = Strings.ErrorCreatingDataStreamTitle.GetLocalizedResource(),
+						Content = Strings.ErrorCreatingDataStreamDescription.GetLocalizedResource(),
+						PrimaryButtonText = "Ok".GetLocalizedResource()
+					};
+
+					if (ApiInformation.IsApiContractPresent("Windows.Foundation.UniversalApiContract", 8))
+						dialog.XamlRoot = MainWindow.Instance.Content.XamlRoot;
+
+					await dialog.TryShowAsync();
+				}
+
+				// Restore read-only attribute (#7534)
+				if (isReadOnly)
+					Win32Helper.SetFileAttribute(itemPath, System.IO.FileAttributes.ReadOnly);
+
+				// Restore date modified
+				if (isDateOk)
+					Win32Helper.SetFileDateModified(itemPath, dateModified);
+			}));
+
+			if (context.ShellPage is null)
+				return;
+
+			if (FoldersSettingsService.AreAlternateStreamsVisible)
+				await context.ShellPage.Refresh_Click();
+			else if (ApplicationSettingsService.ShowDataStreamsAreHiddenPrompt)
+			{
+				var dialog = new ContentDialog
+				{
+					Title = Strings.DataStreamsAreHiddenTitle.GetLocalizedResource(),
+					Content = Strings.DataStreamsAreHiddenDescription.GetLocalizedResource(),
+					PrimaryButtonText = Strings.Yes.GetLocalizedResource(),
+					SecondaryButtonText = Strings.DontShowAgain.GetLocalizedResource()
+				};
+
+				if (ApiInformation.IsApiContractPresent("Windows.Foundation.UniversalApiContract", 8))
+					dialog.XamlRoot = MainWindow.Instance.Content.XamlRoot;
+
+				var result = await dialog.TryShowAsync();
+				if (result == ContentDialogResult.Primary)
+				{
+					FoldersSettingsService.AreAlternateStreamsVisible = true;
+					await context.ShellPage.Refresh_Click();
+				}
+				else
+					ApplicationSettingsService.ShowDataStreamsAreHiddenPrompt = false;
+			}
+		}
+	}
+}

src/Files.App/Actions/FileSystem/CreateAlternateDataStreamAction.cs

@@ -39,77 +39,11 @@ public CreateAlternateDataStreamAction()
 			context.PropertyChanged += Context_PropertyChanged;
 		}
 
-		public async Task ExecuteAsync(object? parameter = null)
-		{
-			var nameDialog = DynamicDialogFactory.GetFor_CreateAlternateDataStreamDialog();
-			await nameDialog.TryShowAsync();
-
-			if (nameDialog.DynamicResult != DynamicDialogResult.Primary)
-				return;
-
-			var userInput = nameDialog.ViewModel.AdditionalData as string;
-			await Task.WhenAll(context.SelectedItems.Select(async selectedItem =>
-			{
-				var itemPath = selectedItem.ItemPath!;
-				var isDateOk = Win32Helper.GetFileDateModified(itemPath, out var dateModified);
-				var isReadOnly = Win32Helper.HasFileAttribute(itemPath, System.IO.FileAttributes.ReadOnly);
-
-				// Unset read-only attribute (#7534)
-				if (isReadOnly)
-					Win32Helper.UnsetFileAttribute(itemPath, System.IO.FileAttributes.ReadOnly);
-
-				if (!Win32Helper.WriteStringToFile($"{itemPath}:{userInput}", ""))
-				{
-					var dialog = new ContentDialog
-					{
-						Title = Strings.ErrorCreatingDataStreamTitle.GetLocalizedResource(),
-						Content = Strings.ErrorCreatingDataStreamDescription.GetLocalizedResource(),
-						PrimaryButtonText = "Ok".GetLocalizedResource()
-					};
-
-					if (ApiInformation.IsApiContractPresent("Windows.Foundation.UniversalApiContract", 8))
-						dialog.XamlRoot = MainWindow.Instance.Content.XamlRoot;
-
-					await dialog.TryShowAsync();
-				}
-
-				// Restore read-only attribute (#7534)
-				if (isReadOnly)
-					Win32Helper.SetFileAttribute(itemPath, System.IO.FileAttributes.ReadOnly);
-
-				// Restore date modified
-				if (isDateOk)
-					Win32Helper.SetFileDateModified(itemPath, dateModified);
-			}));
-
-			if (context.ShellPage is null)
-				return;
-
-			if (FoldersSettingsService.AreAlternateStreamsVisible)
-				await context.ShellPage.Refresh_Click();
-			else if (ApplicationSettingsService.ShowDataStreamsAreHiddenPrompt)
-			{
-				var dialog = new ContentDialog
-				{
-					Title = Strings.DataStreamsAreHiddenTitle.GetLocalizedResource(),
-					Content = Strings.DataStreamsAreHiddenDescription.GetLocalizedResource(),
-					PrimaryButtonText = Strings.Yes.GetLocalizedResource(),
-					SecondaryButtonText = Strings.DontShowAgain.GetLocalizedResource()
-				};
-
-				if (ApiInformation.IsApiContractPresent("Windows.Foundation.UniversalApiContract", 8))
-					dialog.XamlRoot = MainWindow.Instance.Content.XamlRoot;
-
-				var result = await dialog.TryShowAsync();
-				if (result == ContentDialogResult.Primary)
-				{
-					FoldersSettingsService.AreAlternateStreamsVisible = true;
-					await context.ShellPage.Refresh_Click();
-				}
-				else
-					ApplicationSettingsService.ShowDataStreamsAreHiddenPrompt = false;
-			}
-		}
+#if !WINDOWS
+		// LINUX-TODO(streams): this Windows command is hidden on Linux.
+		public Task ExecuteAsync(object? parameter = null)
+			=> Task.CompletedTask;
+#endif
 
 		private void Context_PropertyChanged(object? sender, PropertyChangedEventArgs e)
 		{

src/Files.App/Actions/FileSystem/CreateShortcutAction.cs

@@ -24,6 +24,7 @@ public RichGlyph Glyph
 			=> new(themedIconStyle: "App.ThemedIcons.URL");
 
 		public override bool IsExecutable =>
+			Ioc.Default.GetRequiredService<Files.Platform.Abstractions.IPlatformCapabilities>().SupportsShortcutFiles &&
 			context.HasSelection &&
 			context.CanCreateItem &&
 			UIHelpers.CanShowDialog;
@@ -37,6 +38,9 @@ public CreateShortcutAction()
 
 		public Task ExecuteAsync(object? parameter = null)
 		{
+			if (!IsExecutable)
+				return Task.CompletedTask;
+
 			return UIFilesystemHelpers.CreateShortcutAsync(context.ShellPage, context.SelectedItems);
 		}
 

src/Files.App/Actions/FileSystem/CreateShortcutFromDialogAction.cs

@@ -30,6 +30,7 @@ public RichGlyph Glyph
 			=> new("\uE71B");
 
 		public override bool IsExecutable =>
+			Ioc.Default.GetRequiredService<Files.Platform.Abstractions.IPlatformCapabilities>().SupportsShortcutFiles &&
 			context.CanCreateItem &&
 			UIHelpers.CanShowDialog;
 
@@ -42,6 +43,9 @@ public CreateShortcutFromDialogAction()
 
 		public Task ExecuteAsync(object? parameter = null)
 		{
+			if (!IsExecutable)
+				return Task.CompletedTask;
+
 			return UIFilesystemHelpers.CreateShortcutFromDialogAsync(context.ShellPage!);
 		}