Tcl Source Code

The locale path check added in msgcat 1.6.2 / 1.7.2 (regexp {^[/\\]|^[a-z]+:|(?:^|[/\\])\.\.}, from ticket 301613) does not reject a leading ~. [clock] is aliased into safe interpreters and runs in the parent, and msgcat::Load does file join $langdir $locale.msg then source. On 8.6, file join tilde-expands, so a safe child can make the trusted parent source any .msg file reachable through ~/~user — a full sandbox escape (arbitrary code in the parent). mclocale and clock's -timezone guard both reject such values; the -locale → mcpackagelocale path is weaker.

PoC (Tcl 8.6 with msgcat 1.6.2):

file mkdir ~/tcldemo
set fd [open ~/tcldemo/x.msg w]
puts $fd {puts "PWNED issafe=[interp issafe] exec=[info commands exec]"}
close $fd

interp eval [interp create -safe] {clock format 0 -gmt 1 -locale ~/tcldemo/x}

file delete ~/tcldemo/x.msg

Output:

PWNED issafe=0 exec=exec

i.e. x.msg ran in the trusted parent (issafe=0, exec present), from a one-line call inside a safe child. 9.x is not escapable this way (there file join leaves a leading ~ literal), but it is still affected by the related bypass below.

Fix: also reject a leading ~ (or reuse mclocale's $v eq [file tail $v] test). A related gap on 9.x (msgcat 1.7.2): mcpackagelocale preferences <locale> sets the preference list straight from its args and calls Load without going through getpreferences, so the new regexp never runs and even an absolute path still loads — e.g. mcpackagelocale preferences /abs/x sources /abs/x.msg where mcpackagelocale set /abs/x is correctly rejected. (On 8.6 preferences is read-only, so that route is 9.x-only.) Validating centrally in msgcat::Load would cover every route at once.