System queries with Lua: l3sys-query

[Nicola Talbot]

On 06/03/2024 23:13, Karl Berry wrote:
>      If openin_any is not "a" then clearly you can't read dot files but
>      it isn't clear if they have to be excluded from a directory listing.
> 
> I guess I did not think about this when reviewing Nicola's texosquery
> Java program. It does report dot files (using an escape syntax, but that
> doesn't matter);
> 
> $ mkdir .foo
> $ touch .bar
> $ texosquery-jre8 -i , .
> \fdot bar,\fdot foo
> 
> Therefore I conclude l3sys-query does not need to exclude dot entries
> from its output.
> 
> I can't envision any particular security problem with doing so, and
> clearly it has not been exploited in practice, in any case. --thanks, karl.

texosquery won't show any dot files or any symlink to a dot file with 
openin_any = r (or p)

$ mkdir .foo
$ touch .bar
$ ln -s .bar dotbar
$ touch nodotbar

$ kpsewhich --var-value=openin_any
a
$ texosquery-jre8 -i , .
\fdot foo,\fdot bar,dotbar,nodotbar

$ kpsewhich --var-value=openin_any
r
$ texosquery-jre8 -i , .
nodotbar

I don't know how big a concern symlinks to dot files are.

Regards
Nicola