package installation fail when home dir contains a @

Hello!

I use the guix package manager on ubuntu 22.04.

I have successfully installed fdm and mu packages but I got an error when installing emacs package.

My user is a domain user, the domain name is 'foo.bar' and then sssd use a home directory like '/home/user@foo.bar' which seems to cause that error.

Installation log:

$ LANG=C guix install emacs

The following package will be installed:

emacs 28.2

hint: Backtrace:

17 (primitive-load "/home/user@foo.bar/.config/guix?")

In guix/ui.scm:

2275:7 16 (run-guix . _)

2238:10 15 (run-guix-command _ . _)

In ice-9/boot-9.scm:

1752:10 14 (with-exception-handler _ _ #:unwind? _ # _)

In guix/status.scm:

835:3 13 (_)

815:4 12 (call-with-status-report _ _)

In guix/store.scm:

1300:8 11 (call-with-build-handler _ _)

1300:8 10 (call-with-build-handler #<procedure 7f83d177e480 at g?> ?)

In guix/build/syscalls.scm:

1435:3 9 (_)

1402:4 8 (call-with-file-lock/no-wait _ _ _)

In guix/scripts/package.scm:

325:7 7 (build-and-use-profile _ "/var/guix/profiles/per-user/?" ?)

In guix/ui.scm:

312:5 6 (display-hint _ _)

1448:24 5 (texi->plain-text _)

In texinfo.scm:

1132:22 4 (parse _)

980:31 3 (loop #<input: string 7f83bec67a10> (*fragment*) _ _ _)

967:36 2 (loop #<input: string 7f83bec67a10> #f #<procedure ide?> ?)

92:2 1 (command-spec _)

In ice-9/boot-9.scm:

1685:16 0 (raise-exception _ #:continuable? _)

ice-9/boot-9.scm:1685:16: In procedure raise-exception:

Throw to key `parser-error' with args `(#f "Unknown command" foo)'.

Oh no, do we have a Texi injection vulnerability in Guix? :)

What I understand is that an error occurs when trying to show a hint to the user (display-hint in the backtrace). This calls texi->plain-text which transforms texinfo markup to text for displaying on a terminal. With your user name, it tries to read something like:

/home/~a/.guix-profile/etc/profile

Which is expanded into:

/home/user@foo.bar/.guix-profile/etc/profile

And the @ is understood as texinfo markup but there is no @foo command in texinfo. How do we fix that though?

Le 23 novembre 2022 13:46:30 GMT+01:00, pofman@free.fr a écrit :