From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <sourceware-bugzilla@sourceware.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 543BA3858431; Tue, 10 Oct 2023 19:52:53 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 543BA3858431
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org;
	s=default; t=1696967573;
	bh=MsX9fulxR4jPIVsJ/FMjEAAp5OWBSyqxWiWOz607Prc=;
	h=From:To:Subject:Date:From;
	b=eJO8VLXp8co2lcSNaxjy5HaUnQSZwpVDUshTnC7UMITsaxYTt7Olq4/djMGT9ZoY6
	 Bv27YFTnn/O/YMlYA/fZioAW7EPI5w1tAXiiJa0V6MyT5sdILwpBRTr44auAOeneSq
	 fGxcdB3u6FSVMjb6NyIV74wMDq+a1iB0JkYK9cG0=
From: "fche at redhat dot com" <sourceware-bugzilla@sourceware.org>
To: elfutils-devel@sourceware.org
Subject: [Bug debuginfod/30962] New: ensure x-debuginfod-file / -archive
 headers always return full path names
Date: Tue, 10 Oct 2023 19:52:52 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: elfutils
X-Bugzilla-Component: debuginfod
X-Bugzilla-Version: unspecified
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: fche at redhat dot com
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at sourceware dot org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter cc target_milestone
Message-ID: <bug-30962-10460@http.sourceware.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <elfutils-devel.sourceware.org>

https://sourceware.org/bugzilla/show_bug.cgi?id=3D30962

            Bug ID: 30962
           Summary: ensure x-debuginfod-file / -archive headers always
                    return full path names
           Product: elfutils
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: debuginfod
          Assignee: unassigned at sourceware dot org
          Reporter: fche at redhat dot com
                CC: elfutils-devel at sourceware dot org
  Target Milestone: ---

We kind of decided haphazardly to `basename` some of those strings and not
others.  This was partly with some halfbaked notion of security in mind, to
avoid exposing path names on a server.

We should switch to full path names: basically just return everything in its
raw form: file names, archive names, names-from-archives.  This would simpl=
ify
things, and making naming consistent between x-debuginfod-file: BASENAME and
the forthcoming metadata-query FULLPATH.   And we can document how to strip
sensitive prefixes if admins want to keep things hush-hush.

--=20
You are receiving this mail because:
You are on the CC list for the bug.=