Re: Bug in luatex handling of hidden dirs in TEXMFVAR

Thanks both,

On Thu, Nov 06, 2025 at 05:26:07AM -0700, Max Chernoff wrote:
> This is caused by a LuaTeX engine change in TeX Live 2024. This is
> documented in the TeX Live change log with the rather cryptic
> description
> 
>     LuaTeX:
>     - Lua-level checks for writing to files now similar to the TeX-level
>       checks.
>   ...
> §7.3 of the kpathsea manual expands on this a little more:
>   ...

Oh I see, that is a bit cryptic!

> If you've explicitly set $TEXMFVAR to a value beginning with a dot,
> arguably, that should override the "no filenames beginning with a dot"
> security restriction. But this is a fairly uncommon configuration, so

Probably explicitly setting $TEXMFVAR is uncommon, but when restricting
to these cases, I expect setting it to a filename beginning with a dot
to be fairly common. It is pretty standard for cache directories to be
named `.cache` or similar; indeed, the default luatex-cache directory
lives under (the absolute path) `$HOME/.texlive2025/texmf-var` (at least
on my system).

> while I'm pretty sure that making this change wouldn't cause any
> security issues, it might not be worth the risk of accidentally
> introducing another security vulnerability when modifying the filename
> parsing code.

On Thu, Nov 06, 2025 at 03:31:54PM -0700, Karl Berry wrote:
>     If you've explicitly set $TEXMFVAR to a value beginning with a dot,
>     arguably, that should override the "no filenames beginning with a dot"
> 
> Arguably. But since the workarounds are so easy, I don't much want to
> make yet another special case in the code for it and, as you say, risk
> introducing bugs. --thanks, karl.

I agree that it is not worth introducing a special case here.
I do wonder whether it would be easy to improve the error message here
to reference the documentation.