System queries with Lua: l3sys-query

Nicola Talbot lists at
Thu Mar 7 17:38:58 CET 2024

On 06/03/2024 23:13, Karl Berry wrote:
>      If openin_any is not "a" then clearly you can't read dot files but
>      it isn't clear if they have to be excluded from a directory listing.
> I guess I did not think about this when reviewing Nicola's texosquery
> Java program. It does report dot files (using an escape syntax, but that
> doesn't matter);
> $ mkdir .foo
> $ touch .bar
> $ texosquery-jre8 -i , .
> \fdot bar,\fdot foo
> Therefore I conclude l3sys-query does not need to exclude dot entries
> from its output.
> I can't envision any particular security problem with doing so, and
> clearly it has not been exploited in practice, in any case. --thanks, karl.

texosquery won't show any dot files or any symlink to a dot file with 
openin_any = r (or p)

$ mkdir .foo
$ touch .bar
$ ln -s .bar dotbar
$ touch nodotbar

$ kpsewhich --var-value=openin_any
$ texosquery-jre8 -i , .
\fdot foo,\fdot bar,dotbar,nodotbar

$ kpsewhich --var-value=openin_any
$ texosquery-jre8 -i , .

I don't know how big a concern symlinks to dot files are.


More information about the tex-live mailing list.