Unretirement request: https://pagure.io/releng/fedora-scm-requests/issue/84524

50052eaa91c3c750c51c245799e3747495feeece.patch

@@ -0,0 +1,63 @@
+From 50052eaa91c3c750c51c245799e3747495feeece Mon Sep 17 00:00:00 2001
+From: Victor Kareh <vkareh@redhat.com>
+Date: Thu, 14 May 2026 21:56:38 -0400
+Subject: [PATCH] ev-application: Quote user-supplied strings in ev_spawn
+ command line
+
+When spawning a new xreader instance for cross-document links, the
+destination and search parameters from the document were interpolated
+directly into the command line without shell quoting. Values containing
+spaces or special characters could be split into separate arguments by
+the shell parser, potentially being interpreted as unintended flags by
+the child process.
+
+Apply shell quoting to page label, named destination, and search string
+values before appending them to the command line.
+---
+ shell/ev-application.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/shell/ev-application.c b/shell/ev-application.c
+index a430f9e0..148cfaf8 100644
+--- a/shell/ev-application.c
++++ b/shell/ev-application.c
+@@ -235,18 +235,22 @@ ev_spawn (const char     *uri,
+     /* Page label or index */
+     if (dest) {
+         switch (ev_link_dest_get_dest_type (dest)) {
+-            case EV_LINK_DEST_TYPE_PAGE_LABEL:
+-                g_string_append_printf (cmd, " --page-label=%s",
+-                                        ev_link_dest_get_page_label (dest));
++            case EV_LINK_DEST_TYPE_PAGE_LABEL: {
++                gchar *quoted = g_shell_quote (ev_link_dest_get_page_label (dest));
++                g_string_append_printf (cmd, " --page-label=%s", quoted);
++                g_free (quoted);
+                 break;
++            }
+             case EV_LINK_DEST_TYPE_PAGE:
+                 g_string_append_printf (cmd, " --page-index=%d",
+                                         ev_link_dest_get_page (dest) + 1);
+                 break;
+-            case EV_LINK_DEST_TYPE_NAMED:
+-                g_string_append_printf (cmd, " --named-dest=%s",
+-                                        ev_link_dest_get_named_dest (dest));
++            case EV_LINK_DEST_TYPE_NAMED: {
++                gchar *quoted = g_shell_quote (ev_link_dest_get_named_dest (dest));
++                g_string_append_printf (cmd, " --named-dest=%s", quoted);
++                g_free (quoted);
+                 break;
++            }
+             default:
+                 break;
+         }
+@@ -254,7 +258,9 @@ ev_spawn (const char     *uri,
+ 
+     /* Find string */
+     if (search_string) {
+-        g_string_append_printf (cmd, " --find=%s", search_string);
++        gchar *quoted = g_shell_quote (search_string);
++        g_string_append_printf (cmd, " --find=%s", quoted);
++        g_free (quoted);
+     }
+ 
+     /* Mode */

xreader.spec

@@ -3,12 +3,13 @@
 
 Name:		xreader
 Version:	3.8.4
-Release:	1%{?dist}
+Release:	2%{?dist}
 Summary:	Simple document viewer
 
 License:	GPLv2+
 URL:		https://github.com/linuxmint/%{name}
 Source0:	%{url}/archive/%{version}/%{name}-%{version}.tar.gz
+Patch0:     %{url}/commit/50052eaa91c3c750c51c245799e3747495feeece.patch
 
 ExcludeArch:    %{ix86}
 
@@ -38,7 +39,11 @@ BuildRequires:	pkgconfig(poppler-glib)
 BuildRequires:	pkgconfig(sm)
 BuildRequires:	pkgconfig(xapp) >= 1.4.0
 BuildRequires:	pkgconfig(zlib)
+%if 0%{?fedora} || 0%{?rhel} >= 10
 BuildRequires:	pkgconfig(webkit2gtk-4.1)
+%else
+BuildRequires:	pkgconfig(webkit2gtk-4.0)
+%endif
 BuildRequires:	texlive
 BuildRequires:	t1lib-devel
 BuildRequires:	yelp-tools
@@ -168,6 +173,9 @@ LDFLAGS+=' -lX11 -lICE -lSM'
 %doc %{_datadir}/doc/%{name}*
 
 %changelog
+* Tue May 19 2026 Leigh Scott <leigh123linux@gmail.com> - 3.8.4-2
+- Add patch
+
 * Tue Dec 05 2023 Leigh Scott <leigh123linux@gmail.com> - 3.8.4-1
 - Update to 3.8.4 release