Bug 187780 - ports-mgmt/pkg (and pkg mirrors): packagesite.yaml contains excessive escaping
Summary: ports-mgmt/pkg (and pkg mirrors): packagesite.yaml contains excessive escaping
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-pkg (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-03-20 08:00 UTC by Jeremy Chadwick
Modified: 2014-08-15 15:27 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jeremy Chadwick 2014-03-20 08:00:00 UTC
	Packages installed via "pkg install" which contain double-quotes in their
	Comment (and possibly Description), and/or possibly other characters, are
	excessively escaped (possibly once too many times).

	These escaped values end up making it into packagesite.yaml, which is
	part of packagesite.txz, which is what's downloaded during "pkg update -f".

	I cannot tell if this is a problem with pkg itself (e.g. one of the tools
	that builds packagesite.yaml), or if it's something done by one of the actual
	pkg mirrors itself (in which case someone needs to CC whoever maintains the
	official pkg.freebsd.org mirrors, because it's not disclosed; all I know is
	it's hosted by ISC).

	This situation reminds me of PHP and magic quotes, heh... ;-)
	http://www.php.net/manual/en/security.magicquotes.what.php

Fix: 

n/a
How-To-Repeat: # pkg info | grep python2-2_2
python2-2_2                    The \"meta-port\" for version 2 of the Python interpreter
# pkg info python2-2_2
python2-2_2
Name           : python2
Version        : 2_2
Installed on   : Wed Mar 19 23:19:45 PDT 2014
Origin         : lang/python2
Architecture   : freebsd:9:x86:64
Prefix         : /usr/local
Categories     : python lang ipv6
Maintainer     : python@FreeBSD.org
WWW            : http://www.python.org/
Comment        : The \"meta-port\" for version 2 of the Python interpreter
Flat size      : 0.00B
Description    :
Python is an interpreted object-oriented programming language, and is
often compared to Tcl, Perl or Scheme.
This is a meta port to the Python 2.x interpreter and provides symbolic links
to bin/python2, bin/pydoc2, bin/idle2 and so on to allow compatibility with
minor version agnostic python scripts.

WWW: http://www.python.org/

	Proof it comes from packagesite.yaml:

# mkdir /var/tmp/x
# cd /var/tmp/x
# fetch 'http://pkg.freebsd.org/freebsd:9:x86:64/latest/packagesite.txz'
packagesite.txz                               100% of 5062 kB 2613 kBps 00m02s
# tar -Jxvf packagesite.txz
x packagesite.yaml.sig
x packagesite.yaml.pub
x packagesite.yaml
# grep 'meta-port.*for version 2 of the Python' packagesite.yaml
{"name":"python2","origin":"lang/python2","version":"2_2","comment":"The \\\\\\\"meta-port\\\\\\\" for version 2 of the Python interpreter","arch":"freebsd:9:x86:64","maintainer":"python@FreeBSD.org","prefix":"/usr/local","www":"http://www.python.org/","path":"All/python2-2_2.txz","sum":"766b8efc2679c95bd0604f51fae140ae8f071f77875a97949af3b8dd3e9a4859","licenselogic":"single","flatsize":0,"pkgsize":2340,"desc":"Python is an interpreted object-oriented programming language, and is\noften compared to Tcl, Perl or Scheme.\nThis is a meta port to the Python 2.x interpreter and provides symbolic links\nto bin/python2, bin/pydoc2, bin/idle2 and so on to allow compatibility with\nminor version agnostic python scripts.\n\nWWW: http://www.python.org/","deps":{"python27":{"origin":"lang/python27","version":"2.7.6_4"}},"categories":["lang","python","ipv6"]}

	Talk about excessive escaping...
Comment 1 Edwin Groothuis freebsd_committer freebsd_triage 2014-03-21 05:50:33 UTC
Responsible Changed
From-To: freebsd-ports-bugs->portmgr

Over to maintainer (via the GNATS Auto Assign Tool)
Comment 2 Bryan Drewery freebsd_committer freebsd_triage 2014-08-15 15:27:25 UTC
Fixed in r348386 with 1.2.7:

# pkg info|grep '"'
boost-all-1.55.0               The "meta-port" for boost libraries
diffstat-1.57                  Makes a histogram summarizing \"diff\" output
python-2.7_1,2                 The "meta-port" for the default version of Python interpreter
python2-2_2                    The "meta-port" for version 2 of the Python interpreter
sdocbook-xml-1.1_1,2           "Simplified" DocBook XML DTD