lix/doc/manual/rl-next
Robert Hensing f1b4663805 Disallow store path names that are . or .. (plus opt. -)
As discussed in the maintainer meeting on 2024-01-29.

Mainly this is to avoid a situation where the name is parsed and
treated as a file name, mostly to protect users.
.-* and ..-* are also considered invalid because they might strip
on that separator to remove versions. Doesn't really work, but that's
what we decided, and I won't argue with it, because .-* probably
doesn't seem to have a real world application anyway.
We do still permit a 1-character name that's just "-", which still
poses a similar risk in such a situation. We can't start disallowing
trailing -, because a non-zero number of users will need it and we've
seen how annoying and painful such a change is.

What matters most is preventing a situation where . or .. can be
injected, and to just get this done.
2024-01-31 18:35:19 +01:00
..
allowed-uris-can-now-match-whole-schemes.md
cgroup-stats.md
config
drv-string-parse-hang.md
empty-search-regex.md
env-size-reduction.md
eval-system.md
git-fetcher.md
hash-format-nix32.md
ifd-eval-store.md
leading-period.md
mounted-ssh-store.md
nix-config-show.md
nix-env-json-drv-path.md
nix-flake-check-logs-actions.md
nix-hash-convert.md
nix-profile-names.md
nix-store-add.md
print-value-in-coercion-error.md
print-value-in-type-error.md
source-positions-in-errors.md
stack-overflow-segfaults.md
with-error-reporting.md