[ tcl-Bugs-2854929 ] Cannot load Tcl modules with :: in Safe Base interpreters

[SourceForge.net]

Bugs item #2854929, was opened at 2009-09-08 22:18
Message generated for change (Comment added) made by andreas_kupries
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=2854929&group_id=10894

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: 33. Safe Base
Group: development: 8.6b1.1
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Ashok P. Nadkarni (apnadkarni)
Assigned to: Jeffrey Hobbs (hobbs)
Summary: Cannot load Tcl modules with :: in Safe Base interpreters

Initial Comment:
Logging this as per Andreas Kupries' direction on c.l.t.
Tried on XP, using Active Tcl 8.6b1.1
-------
I've run into an issue with loading Tcl modules into interpreters
created with ::safe::interpCreate. I'm not sure whether this is by
design or a bug. The following piece of code executes without errors

set ip [::safe::interpCreate]
$ip eval {package require uri}

(uri is a package in tcllib, as is uri::urn)

The following errors out
$ip eval {package require uri::urn}

The uri package is loaded from C:/Tcl/lib/teapot/package/tcl/teapot/
tcl8/8.2/uri-1.2.1.tm whereas
the uri::urn package is loaded from C:/Tcl/lib/teapot/package/tcl/
teapot/tcl8/8.4/uri/urn-1.0.2.tm
The issue is that the Tcl module loading system maps a package name
containing :: to subdirectories and while the safe interpreter's -
accessPath contains the .....tcl8/8.2 directory, it does not contain
the subdirectory (uri). Consequently, any Tcl modules with :: in the
package name fail to load.

The question is - is this by design or an oversight ? What is the
danger (from a security perspective) to allow recursion if the
directory path matches the path in the package name?

/Ashok

----------------------------------------------------------------------

>Comment By: Andreas Kupries (andreas_kupries)
Date: 2009-11-03 15:02

Message:
Oversight.

----------------------------------------------------------------------

You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=2854929&group_id=10894

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
Tcl-Bugs mailing list
Tcl-Bugs@...
https://lists.sourceforge.net/lists/listinfo/tcl-bugs