[PATCH 2/2] lib: reject relative paths in n_d_{create,open}_verbose

diff --git a/b9/302fe96532690852855133ac71247d50a5e2cf b/b9/302fe96532690852855133ac71247d50a5e2cf
new file mode 100644 (file)
index 0000000..50baf1a
--- /dev/null
+++ b/b9/302fe96532690852855133ac71247d50a5e2cf
@@ -0,0 +1,216 @@
+Return-Path: <bremner@tesseract.cs.unb.ca>\r
+X-Original-To: notmuch@notmuchmail.org\r
+Delivered-To: notmuch@notmuchmail.org\r
+Received: from localhost (localhost [127.0.0.1])\r
+ by arlo.cworth.org (Postfix) with ESMTP id AA4AD6DE0B2F\r
+ for <notmuch@notmuchmail.org>; Wed, 10 Jun 2015 00:19:24 -0700 (PDT)\r
+X-Virus-Scanned: Debian amavisd-new at cworth.org\r
+X-Spam-Flag: NO\r
+X-Spam-Score: 0.206\r
+X-Spam-Level: \r
+X-Spam-Status: No, score=0.206 tagged_above=-999 required=5 tests=[AWL=0.196, \r
+ T_HEADER_FROM_DIFFERENT_DOMAINS=0.01] autolearn=disabled\r
+Received: from arlo.cworth.org ([127.0.0.1])\r
+ by localhost (arlo.cworth.org [127.0.0.1]) (amavisd-new, port 10024)\r
+ with ESMTP id I7JtQgadaOSg for <notmuch@notmuchmail.org>;\r
+ Wed, 10 Jun 2015 00:19:23 -0700 (PDT)\r
+Received: from mx.xen14.node3324.gplhost.com (gitolite.debian.net\r
+ [87.98.215.224])\r
+ by arlo.cworth.org (Postfix) with ESMTPS id E00076DE02CB\r
+ for <notmuch@notmuchmail.org>; Wed, 10 Jun 2015 00:19:22 -0700 (PDT)\r
+Received: from remotemail by mx.xen14.node3324.gplhost.com with local (Exim\r
+ 4.80) (envelope-from <bremner@tesseract.cs.unb.ca>)\r
+ id 1Z2aGe-0007UE-Ro; Wed, 10 Jun 2015 07:17:44 +0000\r
+Received: (nullmailer pid 5329 invoked by uid 1000); Wed, 10 Jun 2015\r
+ 07:17:09 -0000\r
+From: David Bremner <david@tethera.net>\r
+To: David Bremner <david@tethera.net>, Morgan Veyret\r
+ <morgan.veyret@gmail.com>, notmuch@notmuchmail.org\r
+Subject: [PATCH 2/2] lib: reject relative paths in n_d_{create,open}_verbose\r
+Date: Wed, 10 Jun 2015 09:17:01 +0200\r
+Message-Id: <1433920621-5279-2-git-send-email-david@tethera.net>\r
+X-Mailer: git-send-email 2.1.4\r
+In-Reply-To: <1433920621-5279-1-git-send-email-david@tethera.net>\r
+References: <87oakqj5rm.fsf@maritornes.cs.unb.ca>\r
+ <1433920621-5279-1-git-send-email-david@tethera.net>\r
+X-BeenThere: notmuch@notmuchmail.org\r
+X-Mailman-Version: 2.1.18\r
+Precedence: list\r
+List-Id: "Use and development of the notmuch mail system."\r
+ <notmuch.notmuchmail.org>\r
+List-Unsubscribe: <http://notmuchmail.org/mailman/options/notmuch>,\r
+ <mailto:notmuch-request@notmuchmail.org?subject=unsubscribe>\r
+List-Archive: <http://notmuchmail.org/pipermail/notmuch/>\r
+List-Post: <mailto:notmuch@notmuchmail.org>\r
+List-Help: <mailto:notmuch-request@notmuchmail.org?subject=help>\r
+List-Subscribe: <http://notmuchmail.org/mailman/listinfo/notmuch>,\r
+ <mailto:notmuch-request@notmuchmail.org?subject=subscribe>\r
+X-List-Received-Date: Wed, 10 Jun 2015 07:19:24 -0000\r
+\r
+There are many places in the notmuch code where the path is assumed to be absolute. If someone (TM) wants a project, one could remove these assumptions. In the mean time, prevent users from shooting themselves in the foot.\r
+\r
+Update test suite mark tests for this error as no longer broken, and\r
+also convert some tests that used relative paths for nonexistent\r
+directories.\r
+---\r
+ NEWS                       |  9 +++++++++\r
+ lib/database.cc            | 12 ++++++++++++\r
+ test/T360-symbol-hiding.sh | 21 +++++++++++----------\r
+ test/T560-lib-error.sh     | 10 ++++------\r
+ test/symbol-test.cc        |  6 +++---\r
+ 5 files changed, 39 insertions(+), 19 deletions(-)\r
+\r
+diff --git a/NEWS b/NEWS\r
+index 03254d5..004b867 100644\r
+--- a/NEWS\r
++++ b/NEWS\r
+@@ -1,3 +1,12 @@\r
++Notmuch 0.21 (UNRELEASED)\r
++=========================\r
++\r
++Library\r
++-------\r
++\r
++The use of absolute paths is now enforced when calling notmuch_database_{open, create}\r
++\r
++\r
+ Notmuch 0.20.1 (2015-06-01)\r
+ ===========================\r
+ \r
+diff --git a/lib/database.cc b/lib/database.cc\r
+index e726f62..6a15174 100644\r
+--- a/lib/database.cc\r
++++ b/lib/database.cc\r
+@@ -659,6 +659,12 @@ notmuch_database_create_verbose (const char *path,\r
+       goto DONE;\r
+     }\r
+ \r
++    if (path[0] != '/') {\r
++      message = strdup ("Error: Database path must be absolute.\n");\r
++      status = NOTMUCH_STATUS_PATH_ERROR;\r
++      goto DONE;\r
++    }\r
++\r
+     err = stat (path, &st);\r
+     if (err) {\r
+       IGNORE_RESULT (asprintf (&message, "Error: Cannot create database at %s: %s.\n",\r
+@@ -849,6 +855,12 @@ notmuch_database_open_verbose (const char *path,\r
+       goto DONE;\r
+     }\r
+ \r
++    if (path[0] != '/') {\r
++      message = strdup ("Error: Database path must be absolute.\n");\r
++      status = NOTMUCH_STATUS_PATH_ERROR;\r
++      goto DONE;\r
++    }\r
++\r
+     if (! (notmuch_path = talloc_asprintf (local, "%s/%s", path, ".notmuch"))) {\r
+       message = strdup ("Out of memory\n");\r
+       status = NOTMUCH_STATUS_OUT_OF_MEMORY;\r
+diff --git a/test/T360-symbol-hiding.sh b/test/T360-symbol-hiding.sh\r
+index d2b5d1f..98e4d4d 100755\r
+--- a/test/T360-symbol-hiding.sh\r
++++ b/test/T360-symbol-hiding.sh\r
+@@ -11,16 +11,17 @@ test_description='exception symbol hiding'\r
+ \r
+ . ./test-lib.sh\r
+ \r
+-run_test(){\r
+-    result=$(LD_LIBRARY_PATH="$TEST_DIRECTORY/../lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" $TEST_DIRECTORY/symbol-test 2>&1)\r
+-}\r
+-\r
+-output="A Xapian exception occurred opening database: Couldn't stat 'fakedb/.notmuch/xapian'\r
+-caught No chert database found at path \`./nonexistent'"\r
+-\r
+-mkdir -p fakedb/.notmuch\r
+-\r
+-test_expect_success 'running test' run_test\r
++test_begin_subtest 'running test' run_test\r
++mkdir -p ${PWD}/fakedb/.notmuch\r
++( LD_LIBRARY_PATH="$TEST_DIRECTORY/../lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" \\r
++               $TEST_DIRECTORY/symbol-test ${PWD}/fakedb ${PWD}/nonexistent \\r
++               2>&1 | sed "s,${PWD},CWD,g") > OUTPUT\r
++\r
++cat <<EOF > EXPECTED\r
++A Xapian exception occurred opening database: Couldn't stat 'CWD/fakedb/.notmuch/xapian'\r
++caught No chert database found at path \`CWD/nonexistent'\r
++EOF\r
++test_expect_equal_file EXPECTED OUTPUT\r
+ \r
+ test_begin_subtest 'checking output'\r
+ test_expect_equal "$result" "$output"\r
+diff --git a/test/T560-lib-error.sh b/test/T560-lib-error.sh\r
+index 9f5f7ae..b1e77aa 100755\r
+--- a/test/T560-lib-error.sh\r
++++ b/test/T560-lib-error.sh\r
+@@ -36,7 +36,6 @@ EOF\r
+ test_expect_equal_file EXPECTED OUTPUT\r
+ \r
+ test_begin_subtest "Open relative path"\r
+-test_subtest_known_broken\r
+ test_C <<'EOF'\r
+ #include <stdio.h>\r
+ #include <notmuch.h>\r
+@@ -55,7 +54,6 @@ EOF\r
+ test_expect_equal_file EXPECTED OUTPUT\r
+ \r
+ test_begin_subtest "Create database in relative path"\r
+-test_subtest_known_broken\r
+ test_C <<'EOF'\r
+ #include <stdio.h>\r
+ #include <notmuch.h>\r
+@@ -108,21 +106,21 @@ Error: Cannot create a database for a NULL path.\r
+ EOF\r
+ test_expect_equal_file EXPECTED OUTPUT\r
+ \r
+-test_begin_subtest "Create database in non-existant directory"\r
+-test_C <<'EOF'\r
++test_begin_subtest "Create database in nonexistent directory"\r
++test_C ${PWD}/nonexistent/foo<<'EOF'\r
+ #include <stdio.h>\r
+ #include <notmuch.h>\r
+ int main (int argc, char** argv)\r
+ {\r
+     notmuch_database_t *db;\r
+     notmuch_status_t stat;\r
+-    stat = notmuch_database_create ("./nonexistent/foo", &db);\r
++    stat = notmuch_database_create (argv[1], &db);\r
+ }\r
+ EOF\r
+ cat <<'EOF' >EXPECTED\r
+ == stdout ==\r
+ == stderr ==\r
+-Error: Cannot create database at ./nonexistent/foo: No such file or directory.\r
++Error: Cannot create database at CWD/nonexistent/foo: No such file or directory.\r
+ EOF\r
+ test_expect_equal_file EXPECTED OUTPUT\r
+ \r
+diff --git a/test/symbol-test.cc b/test/symbol-test.cc\r
+index f17ddc8..fb77b41 100644\r
+--- a/test/symbol-test.cc\r
++++ b/test/symbol-test.cc\r
+@@ -4,18 +4,18 @@\r
+ #include <notmuch.h>\r
+ \r
+ \r
+-int main() {\r
++int main(int argc, char** argv) {\r
+   notmuch_database_t *notmuch;\r
+   char *message = NULL;\r
+ \r
+-  if (notmuch_database_open_verbose  ("fakedb", NOTMUCH_DATABASE_MODE_READ_ONLY, &notmuch, &message))\r
++  if (notmuch_database_open_verbose  (argv[1], NOTMUCH_DATABASE_MODE_READ_ONLY, &notmuch, &message))\r
+       if (message) {\r
+         fputs (message, stderr);\r
+         free (message);\r
+       }\r
+ \r
+   try {\r
+-    (void) new Xapian::WritableDatabase("./nonexistent", Xapian::DB_OPEN);\r
++    (void) new Xapian::WritableDatabase(argv[2], Xapian::DB_OPEN);\r
+   } catch (const Xapian::Error &error) {\r
+     printf("caught %s\n", error.get_msg().c_str());\r
+     return 0;\r
+-- \r
+2.1.4\r
+\r