Re: Bug in luatex handling of hidden dirs in TEXMFVAR

Hi Ben,

On Wed, 2025-11-05 at 22:49 +0000, Ben Price via tex-live wrote:
> This only happens if the `TEXMFVAR` is a relative path with some component
> starting with a dot -- `TEXMFVAR=texmfhome/texmfvar` works, as does
> `TEXMFVAR=/tmp/.texmfhome/texmfvar`.

This is caused by a LuaTeX engine change in TeX Live 2024. This is
documented in the TeX Live change log with the rather cryptic
description

    LuaTeX:
    - Lua-level checks for writing to files now similar to the TeX-level
      checks.

    (https://tug.org/texlive/doc/texlive-en/texlive-en.html#x1-930009.1.21)

§7.3 of the kpathsea manual expands on this a little more:

    In the implementation, the main security feature to disallow writing
    to potentially dangerous files is a configuration variable
    openout_any. It specifies one of three levels:

    - When set to ‘a’ (for “any”), no restrictions are imposed.

    - When is set to ‘r’ (for “restricted”), filenames beginning with
      ‘.’ are disallowed.

    - When set to ‘p’ (for “paranoid”), additional restrictions are
      imposed.

      1. First, an absolute filename must refer to a file in (or in a
         subdirectory of) either the TEXMF_OUTPUT_DIRECTORY environment
         variable or the TEXMFOUTPUT environment variable or
         configuration file setting.

      2. LuaTeX uses a so-called “extended” mode, in which the values of
         TEXMFVAR and TEXMFSYSVAR are also checked for absolute
         filenames. This is done because, in practice, fundamental parts
         of the LuaLATEX system (notably luaotfload) need a cache
         directory, and historically the TEXMF[SYS]VAR variables are
         what has been used. We neither recommend nor expect any other
         programs to need this.

      3. Finally, any attempt to go up a directory level is forbidden;
         that is, paths may not contain a ‘..’ component.

    The paranoid setting is the default.

    (https://texdoc.org/serve/kpathsea/0#Safe%20filenames)

> This only happens if the `TEXMFVAR` is a relative path with some component
> starting with a dot -- `TEXMFVAR=texmfhome/texmfvar` works, as does
> `TEXMFVAR=/tmp/.texmfhome/texmfvar`.

That's probably the best workaround for this problem. Another solution
would be to set "openout_any=a" in your "texmf.cnf" file, but this will
substantially decrease the security of your TeX Live installation (which
only matters if you ever compile untrusted files).

If you've explicitly set $TEXMFVAR to a value beginning with a dot,
arguably, that should override the "no filenames beginning with a dot"
security restriction. But this is a fairly uncommon configuration, so
while I'm pretty sure that making this change wouldn't cause any
security issues, it might not be worth the risk of accidentally
introducing another security vulnerability when modifying the filename
parsing code.

Karl, what do you think?

Thanks,
-- Max