From: Tomi Ollila <tomi.ollila@iki.fi>
To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>,
 David Bremner <david@tethera.net>, Notmuch Mail <notmuch@notmuchmail.org>
Subject: Re: [PATCH v4 01/16] add util/search-path.{c,
 h} to test for executables in $PATH
In-Reply-To: <87mvkhrfjl.fsf@alice.fifthhorseman.net>
References: <1467970047-8013-1-git-send-email-dkg@fifthhorseman.net>
 <1467970047-8013-2-git-send-email-dkg@fifthhorseman.net>
 <878tw2r0vf.fsf@maritornes.cs.unb.ca>
 <87k2fmse5h.fsf@alice.fifthhorseman.net>
 <87y442phbm.fsf@maritornes.cs.unb.ca>
 <87mvkhrfjl.fsf@alice.fifthhorseman.net>
User-Agent: Notmuch/0.22+61~geeecb9e (https://notmuchmail.org) Emacs/24.5.1
 (x86_64-unknown-linux-gnu)
Date: Fri, 12 Aug 2016 23:01:36 +0300
Message-ID: <m2bn0xkb8f.fsf@guru.guru-group.fi>
MIME-Version: 1.0
Content-Type: text/plain
Precedence: list

On Fri, Aug 12 2016, Daniel Kahn Gillmor <dkg@fifthhorseman.net> wrote:

> On Fri 2016-08-12 03:38:53 -0400, David Bremner wrote:
>> Daniel Kahn Gillmor <dkg@fifthhorseman.net> writes:
>>
>>>> Should we distinguish between relative and absolute paths here?  I can't
>>>> think of any security implications, but I'm wondering if a relative path
>>>> is likely just a user error.
>>>
>>> I don't think a relative path is necessarily a user error.  I certainly
>>> use relative paths myself from time to time.
>>
>> As configuration values? That seems quite fragile, since it depends on
>> the current working directory when notmuch is run.
>
> rarely!  but sometimes i do it because i'm testing things in strange
> ways, and it can be a bit frustrating to have a tool second-guess me
> when it seems like i ought to be able to drop the same string i'm using
> on the command line into the configuration.
>
> I don't feel strongly, though.  if you want to say that bare words found
> in the $PATH and absolute filenames (starting with /) are fine in the
> notmuch config but relative paths are not, i'd be ok with that :)

>From consistency point of view, current patch not checking it being
absolute might prevail -- I don't see database.path being checked for
being absolute...

The probability for user error is pretty small there -- if there is
typo/thinko there things usually just starts failing. Security is
easier to break elsewhere than here (e.g. borken PATH...)

I'd keep the current implementation of test_for_executable()...

Tomi

>
>         --dkg