Bug#754041: "apt-get build-dep <pkgname>" no longer secure when cwd=/tmp

[Jakub Wilk <jwilk@debian.org>]

* David Kalnischkies <david@kalnischkies.de>, 2014-07-07, 23:32:
> >  # apt-get build-dep nyancat
>
> Even if we ignore security for a moment I am not a fan of this syntax 
> as it is too suprising for me.

I don't like it either. :)

> I think I would be happier if this would always require a 
> relative/absolute path rather than just a directory name ala: apt-get 
> build-dep ./nyancat
>
> (aka: at least one / in the pkgname before a file lookup is attempt. 
> And a message like those for regex/glob if it matched anything)

Note that this was valid syntax in apt (<< 1.1):

# apt-get build-dep nyancat/unstable

So we might need a stricter rule than "at least one / ...".

Perhaps something like this: the argument must start with "./" or start 
with "/" or end with "/" to be considered a directory name?

--
Jakub Wilk