Tcl Source Code

On Windows, file normalize can silently remove a path component when the complete path is accessible by its exact name, but an intermediate directory may be traversed without being enumerated.

For example, an existing path ending in:

profilecomponent/app/machteld.exe

is normalized to:

profilecomponent//machteld.exe

The returned normalized path no longer names the original file.

This is a valid Windows ACL configuration. It also occurs with sandboxed processes that receive access to a known descendant without permission to enumerate its parent.

Versions and environment

Runtime reproduced with:

• Tcl 9.0.3, regular Windows build
• Tcl 8.6.17
• Windows 11 Pro x64
• PowerShell 5.1

Inspection of win/tclWinFile.c shows the same relevant branch in Tcl 9.0.4:

Tcl 9.0.4 source

Tk is not involved; the issue is in Tcl core.

Related historical reports

This is closely related to Tcl bugs #4738 / 3092089 and #5124 / 3587096. Those reports documented the same component loss—and the latter an init.tcl startup failure—when directory listing was denied around Windows junctions. They were closed as fixed in 2013 after a change to reparse-point access.

The present reproducer uses only ordinary directories, not junctions or other reparse points, and still triggers the generic FindFirstFileW failure branch in Tcl 8.6.17 and 9.0.3. The same branch remains in the 9.0.4 source. This therefore appears to be a non-junction case that the 2013 reparse-point fix did not cover.

Reproducer

This script creates a unique temporary fixture, adds a non-inheriting ListDirectory denial only to one fixture directory, runs Tcl, restores the original ACL, and removes the fixture. It does not require elevation. The temporary filesystem must support Windows ACLs.

Save it as repro.ps1 and pass the path to a Windows tclsh.

param(
    [Parameter(Mandatory = $true, Position = 0)]
    [string] $Tclsh
)

$ErrorActionPreference = 'Stop'
$root = Join-Path $env:TEMP (
    'tcl-normalize-repro-' + [guid]::NewGuid().ToString('N')
)
$blocked = Join-Path $root 'profilecomponent'
$child = Join-Path $blocked 'app'
$target = Join-Path $child 'machteld.exe'
$originalSddl = $null
$aclChanged = $false

try {
    [void][IO.Directory]::CreateDirectory($child)
    $created = [IO.File]::Create($target)
    $created.Dispose()

    $acl = Get-Acl -LiteralPath $blocked
    $originalSddl = $acl.Sddl
    $deny = [Security.AccessControl.FileSystemAccessRule]::new(
        [Security.Principal.WindowsIdentity]::GetCurrent().User,
        [Security.AccessControl.FileSystemRights]::ListDirectory,
        [Security.AccessControl.InheritanceFlags]::None,
        [Security.AccessControl.PropagationFlags]::None,
        [Security.AccessControl.AccessControlType]::Deny
    )
    [void]$acl.AddAccessRule($deny)
    Set-Acl -LiteralPath $blocked -AclObject $acl
    $aclChanged = $true

    try {
        $stream = [IO.File]::Open(
            $target,
            [IO.FileMode]::Open,
            [IO.FileAccess]::Read,
            ([IO.FileShare]::ReadWrite -bor [IO.FileShare]::Delete)
        )
        $stream.Dispose()
        'direct-exact-open=SUCCESS'
    } catch {
        "direct-exact-open=FAILED: $($_.Exception.Message)"
    }

    try {
        [void][IO.Directory]::GetFileSystemEntries($blocked)
        'parent-enumeration=UNEXPECTED-SUCCESS'
    } catch {
        $errorObject = $_.Exception
        if ($errorObject.InnerException) {
            $errorObject = $errorObject.InnerException
        }
        "parent-enumeration=$($errorObject.GetType().FullName)"
    }

    $env:TCL_NORMALIZE_REPRO_PATH = $target

    @'
set p $::env(TCL_NORMALIZE_REPRO_PATH)
set n [file normalize $p]

puts "tcl=[info patchlevel]"
puts "input=[string map {\ /} $p]"
puts "input-exists=[file exists $p]"
puts "normalized=$n"
puts "normalized-exists=[file exists $n]"
'@ | & $Tclsh
} finally {
    Remove-Item Env:TCL_NORMALIZE_REPRO_PATH -ErrorAction SilentlyContinue

    if ($aclChanged) {
        $restoredAcl = [Security.AccessControl.DirectorySecurity]::new()
        $restoredAcl.SetSecurityDescriptorSddlForm($originalSddl)
        Set-Acl -LiteralPath $blocked -AclObject $restoredAcl
    }

    if ([IO.Directory]::Exists($root)) {
        Remove-Item -LiteralPath $root -Recurse -Force
    }
}

Example invocation:

powershell -NoProfile -File .\repro.ps1 C:\path\to\tclsh90.exe

Actual result

With Tcl 9.0.3:

direct-exact-open=SUCCESS
parent-enumeration=System.UnauthorizedAccessException
tcl=9.0.3
input=C:/.../profilecomponent/app/machteld.exe
input-exists=1
normalized=C:/.../profilecomponent//machteld.exe
normalized-exists=0

The same component loss was reproduced with Tcl 8.6.17.

Expected result

Because the exact path exists and is accessible, normalization should retain every component:

normalized=C:/.../profilecomponent/app/machteld.exe
normalized-exists=1

If Tcl cannot discover the canonical spelling of app without enumerating its parent, preserving the supplied spelling would be preferable to deleting the component. Returning an error would also preserve path integrity better than returning a different path.

Apparent cause

In TclpObjNormalizePath() in win/tclWinFile.c, GetFileAttributesExW() first establishes that the exact path prefix exists. Tcl then calls FindFirstFileW() to obtain the filesystem spelling of the current component.

A direct Win32 probe against the same ACL fixture confirms:

• the exact child file can be opened;
• GetFileAttributesExW(.../profilecomponent/app) returns TRUE;
• FindFirstFileW(.../profilecomponent/app) returns INVALID_HANDLE_VALUE with GetLastError() equal to 5 (ERROR_ACCESS_DENIED).

The INVALID_HANDLE_VALUE branch does not inspect GetLastError(). It assumes the failure is the root-directory case described by its comment and appends only a slash:

handle = FindFirstFileW((WCHAR *) nativePath, &fData);
if (handle == INVALID_HANDLE_VALUE) {
    /*
     * This is usually the '/' in 'c:/' at end of string.
     */
    Tcl_DStringAppend(&dsNorm, (const char *) L"/",
            sizeof(WCHAR));
}

For a normal component such as app, this silently replaces the component with a slash.

Impact

This is not limited to artificial ACLs. It can occur under application sandboxes and capability-based access arrangements where a process can open a known file but cannot list one of its ancestors.

It was encountered with a standalone Tcl/Tk application located below a restricted user-profile directory. Tcl normalized the executable path before reopening it for ZIPFS mounting. The corrupted path prevented the embedded Tcl library from being mounted, so startup subsequently failed while looking for init.tcl.

More generally, file normalize can return a nonexistent path for an existing, accessible file.

Possible conservative fix

For a non-root component whose existence was already established by GetFileAttributesExW(), if FindFirstFileW() cannot retrieve its canonical spelling, one conservative response would be either:

• retain the component spelling from the input path; or
• return a Tcl error.

The drive or UNC root case can be recognized structurally. For other FindFirstFileW() failures, inspecting GetLastError() and preserving the supplied component spelling for access-related failures—or returning an error—would avoid silently deleting the component. A not-found or race condition may need separate treatment.

A Windows regression test using a non-inheriting ListDirectory denial would cover this configuration.

Reported by Vincent Vercauteren.