[ tcl-Bugs-2854929 ] Cannot load Tcl modules with :: in Safe Base interpreters

[SourceForge.net]

Bugs item #2854929, was opened at 2009-09-08 22:18
Message generated for change (Comment added) made by andreas_kupries
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=2854929&group_id=10894

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: 33. Safe Base
Group: development: 8.6b1.1
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Ashok P. Nadkarni (apnadkarni)
>Assigned to: Andreas Kupries (andreas_kupries)
Summary: Cannot load Tcl modules with :: in Safe Base interpreters

Initial Comment:
Logging this as per Andreas Kupries' direction on c.l.t.
Tried on XP, using Active Tcl 8.6b1.1
-------
I've run into an issue with loading Tcl modules into interpreters
created with ::safe::interpCreate. I'm not sure whether this is by
design or a bug. The following piece of code executes without errors

set ip [::safe::interpCreate]
$ip eval {package require uri}

(uri is a package in tcllib, as is uri::urn)

The following errors out
$ip eval {package require uri::urn}

The uri package is loaded from C:/Tcl/lib/teapot/package/tcl/teapot/
tcl8/8.2/uri-1.2.1.tm whereas
the uri::urn package is loaded from C:/Tcl/lib/teapot/package/tcl/
teapot/tcl8/8.4/uri/urn-1.0.2.tm
The issue is that the Tcl module loading system maps a package name
containing :: to subdirectories and while the safe interpreter's -
accessPath contains the .....tcl8/8.2 directory, it does not contain
the subdirectory (uri). Consequently, any Tcl modules with :: in the
package name fail to load.

The question is - is this by design or an oversight ? What is the
danger (from a security perspective) to allow recursion if the
directory path matches the path in the package name?

/Ashok

----------------------------------------------------------------------

>Comment By: Andreas Kupries (andreas_kupries)
Date: 2009-11-05 13:01

Message:
Fix is in head now too, with lots of other changes to bring this piece of
code up to date.
Closing.


----------------------------------------------------------------------

Comment By: Andreas Kupries (andreas_kupries)
Date: 2009-11-04 09:56

Message:
Ok. A fix has been committed to the Tcl 8.5 branch, in time for the
upcoming 8.5.8.
Fix for head will come in short order. Delayed because I made a number of
additional changes to bring the internal up to date with features of 8.5+,
and remove crufty weirdness.

----------------------------------------------------------------------

Comment By: Andreas Kupries (andreas_kupries)
Date: 2009-11-03 15:02

Message:
Oversight.

----------------------------------------------------------------------

You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=2854929&group_id=10894

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
Tcl-Bugs mailing list
Tcl-Bugs@...
https://lists.sourceforge.net/lists/listinfo/tcl-bugs