bug#19540: repeated ./././ in compiled modules

[Ludovic Courtès]

Matt Wette <address@hidden> skribis:

> Absolute paths work.  But this is really unsatisfactory IMO.  I develop code 
> in modules and do so in many directories.  It would be quite painful to just 
> use absolute paths.
>
> I don't see what the big security thread is.

Suppose we’re working on the same machine and I install
/tmp/ice-9/regex.scm (say), which just does:

  (system "rm -rf /")

If I can tweak you into running Guile with /tmp as its current working
directory, you lose.

> If really a problem, why does guile allow relative paths?
>
> For comparison, Python will load modules in the current directory.
>
> Nonetheless, I think "." is breaking the traceback with the "./" being
> added on reload.  When I was using "." I wasn't getting file, line
> information in tracebacks.  Now, without GUILE_LOAD_PATH set to
> ":$HOME/opt/guile" I get traceback info for modules in my current
> directory.

Actually the problem stems from the “file name relative
canonicalization”, the process by which Guile attaches a file name
relative to the search path to an open port:

--8<---------------cut here---------------start------------->8---
scheme@(guile-user)> (add-to-load-path ".")
scheme@(guile-user)> %load-path
$2 = ("." [...])
scheme@(guile-user)> (getcwd)
$3 = "/home/ludo/src/guile/module/ice-9"
scheme@(guile-user)> (open-input-file (search-path %load-path "boot-9.scm"))
$4 = #<input: ./boot-9.scm 11>
scheme@(guile-user)> (open-input-file (search-path %load-path "./boot-9.scm"))
$5 = #<input: ././boot-9.scm 12>
scheme@(guile-user)> (open-input-file (search-path %load-path "././boot-9.scm"))
$6 = #<input: ./././boot-9.scm 13>
--8<---------------cut here---------------end--------------->8---

This could be fixed either in ‘search-path’ or in
‘scm_i_relativize_path’, but the former sounds like a better place.

However, I’m unsure of the effect of changing the result of
‘search-path’ in those cases, so I’d rather leave things unchanged.

Thoughts?

Ludo’.