Bug#949435: apt-ftparchive: package filenames are not canonicalized
Package: apt-utils
Version: 1.8.2
Severity: minor
Dear Maintainer,
Packages files created by apt-ftparchive will sometimes contain non-
canonicalized filenames, e.g. "./pool/dummy_1.0_all.deb". This conflicts with
the field's format specification, according to the wiki
(https://wiki.debian.org/DebianRepository/Format#Filename).
The problem occurs whenever the "path" parameter contains "." or ".." in any
combination. Presumably, the path is just used as-is without any attempt at
canonicalization.
Steps to reproduce (one example):
equivs-build /dev/null
apt-ftparchive packages .
The resulting output will contain a Filename field with a non-canonical path:
Filename: ./equivs-dummy_1.0_all.deb
Regards,
Robin
-- System Information:
Debian Release: 10.2
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.19.0-6-amd64 (SMP w/12 CPU cores)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages apt-utils depends on:
ii apt 1.8.2
ii libapt-inst2.0 1.8.2
ii libapt-pkg5.0 1.8.2
ii libc6 2.28-10
ii libdb5.3 5.3.28+dfsg1-0.5
ii libgcc1 1:8.3.0-6
ii libstdc++6 8.3.0-6
apt-utils recommends no packages.
apt-utils suggests no packages.
-- no debconf information
Reply to: