Tcl Source Code

When a command in a safe interpreter is an alias to a proc in a trusted parent and that proc fails, the full -errorinfo and -errorstack of the parent are copied into the safe interpreter. The safe interpreter then sees the parent's proc names, the text of their bodies, file names of sourced scripts and, through -errorstack, the actual argument values of every parent proc on the call stack.

proc GetPassword {user} {return hunter2}
proc VerifyPassword {user pw} {error "access denied"}
proc LoginAlias {user} {VerifyPassword $user [GetPassword $user]}
set s [interp create -safe]
interp alias $s login {} LoginAlias
puts [interp eval $s {
    catch {login alice} msg opts
    list $::errorInfo [dict get $opts -errorstack]
}]

Actual output (9.1, 9.0, 8.6):

{access denied
    while executing
"error "access denied""
    (procedure "VerifyPassword" line 1)
    invoked from within
"VerifyPassword $user [GetPassword $user]"
    (procedure "LoginAlias" line 1)
    invoked from within
"login alice"} {INNER {returnImm {access denied} {}} CALL {VerifyPassword alice hunter2} CALL {LoginAlias alice}}

Expected: the safe interpreter sees only the error message and its own part of the traceback, as if login were a C command failing with that message:

{access denied
    invoked from within
"login alice"} {}

Cause: AliasObjCmd in generic/tclInterp.c calls Tcl_TransferResult, which copies the whole return options dictionary (Tcl_GetReturnOptions) of the parent into the child, whether the child is safe or not. The Safe Base avoids this only because its alias procs rethrow with [return -code error $msg]; user-defined aliases get no such protection. A possible fix is to drop -errorinfo and -errorstack (keeping the message, -errorcode and the return code) when the target interpreter is safe and the source is not.

This is the knownBug test interp-26.8, one of the tests collected in [219164ffff] (bug 1637, 1999). The errorInfo part has been there at least since 8.4; -errorstack (8.6) made it worse, since it carries argument values. Related: [77f0dbc0f8] (a stale -errorstack from an earlier, already caught error in the parent is also passed through an alias, because Tcl_GetReturnOptions ignores resetErrorStack), [1669424fff] (file names leak into safe interps via [info frame]).