diff -up kleopatra-19.12.2/src/kleopatraapplication.cpp.me kleopatra-19.12.2/src/kleopatraapplication.cpp

--- kleopatra-19.12.2/src/kleopatraapplication.cpp.me	2020-10-12 11:33:05.987075995 +0200

+++ kleopatra-19.12.2/src/kleopatraapplication.cpp	2020-10-12 11:37:47.047704984 +0200

@@ -267,13 +267,18 @@ QString KleopatraApplication::newInstanc

     QStringList files;

     const QDir cwd = QDir(workingDirectory);

-    Q_FOREACH (const QString &file, parser.positionalArguments()) {

-        // We do not check that file exists here. Better handle

-        // these errors in the UI.

-        if (QFileInfo(file).isAbsolute()) {

-            files << file;

-        } else {

-            files << cwd.absoluteFilePath(file);

+    bool queryMode = parser.isSet(QStringLiteral("query")) || parser.isSet(QStringLiteral("search"));

+

+    // Query and Search treat positional arguments differently, see below.

+    if (!queryMode) {

+        Q_FOREACH (const QString &file, parser.positionalArguments()) {

+            // We do not check that file exists here. Better handle

+            // these errors in the UI.

+            if (QFileInfo(file).isAbsolute()) {

+                files << file;

+            } else {

+                files << cwd.absoluteFilePath(file);

+            }

         }

     }

@@ -307,10 +312,8 @@ QString KleopatraApplication::newInstanc

     // Handle openpgp4fpr URI scheme

     QString needle;

-    if (parser.isSet(QStringLiteral("search"))) {

-        needle = parser.value(QStringLiteral("search"));

-    } else if (parser.isSet(QStringLiteral("query"))) {

-        needle = parser.value(QStringLiteral("query"));

+    if (queryMode) {

+        needle = parser.positionalArguments().join(QLatin1Char(' '));

     }

     if (needle.startsWith(QLatin1String("openpgp4fpr:"))) {

         needle.remove(0, 12);

diff -up kleopatra-19.12.2/src/kleopatra_options.h.me kleopatra-19.12.2/src/kleopatra_options.h

--- kleopatra-19.12.2/src/kleopatra_options.h.me	2020-10-12 11:28:44.805768637 +0200

+++ kleopatra-19.12.2/src/kleopatra_options.h	2020-10-12 11:40:35.288476417 +0200

@@ -79,8 +79,7 @@ static void kleopatra_options(QCommandLi

                                   << QStringLiteral("D"),

                                   i18n("Decrypt and/or verify file(s)"))

             << QCommandLineOption(QStringList() << QStringLiteral("search"),

-                                  i18n("Search for a certificate on a keyserver"),

-                                  QStringLiteral("search string"))

+                                  i18n("Search for a certificate on a keyserver"))

             << QCommandLineOption(QStringList() << QStringLiteral("checksum"),

                                   i18n("Create or check a checksum file"))

             << QCommandLineOption(QStringList() << QStringLiteral("query")

@@ -88,8 +87,7 @@ static void kleopatra_options(QCommandLi

                                   i18nc("If a certificate is already known it shows the certificate details dialog."

                                         "Otherwise it brings up the certificate search dialog.",

                                         "Show details of a local certificate or search for it on a keyserver"

-                                        " by fingerprint"),

-                                  QStringLiteral("fingerprint"))

+                                        " by fingerprint"))

             << QCommandLineOption(QStringList() << QStringLiteral("gen-key"),

                                   i18n("Create a new key pair or certificate signing request"))

             << QCommandLineOption(QStringLiteral("parent-windowid"),

@@ -99,11 +97,22 @@ static void kleopatra_options(QCommandLi

                                   i18n("Open the config dialog"));

     parser->addOptions(options);

+    /* Security note: To avoid code execution by shared library injection

+     * through e.g. -platformpluginpath any external input should be seperated

+     * by a double dash -- this is why query / search uses positional arguments.

+     *

+     * For example on Windows there is an URLhandler for openpgp4fpr:

+     * be opened with Kleopatra's query function. And while a browser should

+     * urlescape such a query there might be tricks to inject a quote character

+     * and as such inject command line options for Kleopatra in an URL. */

     parser->addVersionOption();

     parser->addHelpOption();

     parser->addPositionalArgument(QStringLiteral("files"),

                                   i18n("File(s) to process"),

-                                  QStringLiteral("[files..]"));

+                                  QStringLiteral("-- [files..]"));

+     parser->addPositionalArgument(QStringLiteral("query"),

+                                  i18n("String or Fingerprint for query and search"),

+                                  QStringLiteral("-- [query..]"));

 }

 #endif