Package: aptitude
Version: 0.6.11-1+b1
Severity: normal
Dear Maintainer,
I know that whitespaces other than space itself are very unlikely to be
used in user tags, but aptitude silently accepts any of them even though
they are not handled correctly.
With newlines you can do a little injection:
# aptitude search '^coreutils$'
i coreutils - GNU core utilities
# aptitude add-user-tag $'\nState:3' coreutils
# aptitude search '^coreutils$'
id coreutils - GNU core utilities
(now it is marked for removal)
Or you can make aptitude unusable:
# aptitude add-user-tag $'foo bar\n' coreutils
# aptitude install bash
[ ERR] Reading extended state information
[ ERR] Initializing package states
[ ERR] Initializing package states
E: Unterminated '"' in the user-tags list of the package coreutils.
[ ERR] Reading extended state information
[ ERR] Initializing package states
[ ERR] Initializing package states
E: Unterminated '"' in the user-tags list of the package coreutils.
Also, other whitespaces like tab are treated differently from normal spaces:
# aptitude add-user-tag 'foo bar' coreutils
(adds the single tag 'foo bar')
# aptitude remove-user-tag 'foo bar' coreutils
(removes it)
# aptitude add-user-tag $'foo\tbar' coreutils
(adds two tags, 'foo' and 'bar')
# aptitude remove-user-tag $'foo\hbar' coreutils
(no effect)
# aptitude remove-user-tag bar coreutils
(now only 'foo' is left)
Given pkgstates' email header-like format and the csv-like format for
the subfields, perhaps the sensible solution for the newline problem
would be to just forbid newline in tags.
About the other problem, I noticed that tags not containing at least one
space (x20), double quote or backslash are never written in quoted form,
but if they contain other whitespaces they probably should.
(an empty string as a tag name is also accepted and written unquoted
which has no effect)
-- Package-specific info:
Terminal: xterm
$DISPLAY not set.
which aptitude: /usr/bin/aptitude
aptitude version information:
aptitude 0.6.11 compiled at Nov 8 2014 13:34:39
Compiler: g++ 4.9.1
Compiled against:
apt version 4.12.0
NCurses version 5.9
libsigc++ version: 2.4.0
Gtk+ support disabled.
Qt support disabled.
Current library versions:
NCurses version: ncurses 5.9.20140913
cwidget version: 0.5.17
Apt version: 4.12.0
aptitude linkage:
linux-vdso.so.1 (0x00007ffe5afd8000)
libapt-pkg.so.4.12 => /usr/lib/x86_64-linux-gnu/libapt-pkg.so.4.12
(0x00007f2b6b1c4000)
libncursesw.so.5 => /lib/x86_64-linux-gnu/libncursesw.so.5
(0x00007f2b6af8e000)
libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5
(0x00007f2b6ad64000)
libsigc-2.0.so.0 => /usr/lib/x86_64-linux-gnu/libsigc-2.0.so.0
(0x00007f2b6ab5e000)
libcwidget.so.3 => /usr/lib/x86_64-linux-gnu/libcwidget.so.3
(0x00007f2b6a848000)
libsqlite3.so.0 => /usr/lib/x86_64-linux-gnu/libsqlite3.so.0
(0x00007f2b6a57f000)
libboost_iostreams.so.1.55.0 =>
/usr/lib/x86_64-linux-gnu/libboost_iostreams.so.1.55.0 (0x00007f2b6a367000)
libxapian.so.22 => /usr/lib/libxapian.so.22 (0x00007f2b69f56000)
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0
(0x00007f2b69d39000)
libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6
(0x00007f2b69a2e000)
libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f2b6972d000)
libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1
(0x00007f2b69517000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f2b6916e000)
libutil.so.1 => /lib/x86_64-linux-gnu/libutil.so.1 (0x00007f2b68f6b000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f2b68d67000)
libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f2b68b4c000)
libbz2.so.1.0 => /lib/x86_64-linux-gnu/libbz2.so.1.0
(0x00007f2b6893c000)
liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007f2b68719000)
librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f2b68511000)
libuuid.so.1 => /lib/x86_64-linux-gnu/libuuid.so.1 (0x00007f2b6830c000)
/lib64/ld-linux-x86-64.so.2 (0x00007f2b6bb86000)
-- System Information:
Debian Release: 8.1
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 3.16.0-4-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages aptitude depends on:
ii aptitude-common 0.6.11-1
ii libapt-pkg4.12 1.0.9.8
ii libboost-iostreams1.55.0 1.55.0+dfsg-3
ii libc6 2.19-18
ii libcwidget3 0.5.17-2
ii libgcc1 1:4.9.2-10
ii libncursesw5 5.9+20140913-1+b1
ii libsigc++-2.0-0c2a 2.4.0-1
ii libsqlite3-0 3.8.7.1-1+deb8u1
ii libstdc++6 4.9.2-10
ii libtinfo5 5.9+20140913-1+b1
ii libxapian22 1.2.19-1
Versions of packages aptitude recommends:
pn aptitude-doc-en | aptitude-doc <none>
pn libparse-debianchangelog-perl <none>
ii sensible-utils 0.0.9
Versions of packages aptitude suggests:
pn apt-xapian-index <none>
pn debtags <none>
ii tasksel 3.31+deb8u1
-- no debconf information
_______________________________________________
Aptitude-devel mailing list
[email protected]
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/aptitude-devel
