Bug#370282: Worth mentioning that Gnome needs a fix for newer Autoconf?

[Paul Eggert]

Ben Pfaff <blp at cs.stanford.edu> writes:

> However, I wonder whether it's worth mentioning breakage of
> important software like Gnome in Autoconf's NEWS (or elsewhere),

Well, the general topic is already in NEWS.  I doubt whether the
Autoconf maintainers can keep track of which versions of which other
packages will run into problems with the datarootdir change (not to
mention half a dozen similar changes :-).

>  The problem is in AM_GLIB_DEFINE_LOCALEDIR from
>  m4macros/glib-gettext.m4 which hardcodes a double shell expansion:
>    localedir=`eval echo "${datadir}/locale"`
>
>  this results in a config.h with:
>      #define GNOMELOCALEDIR "${prefix}/share/locale"
>  which will obviously break at runtime.
>
>  I verified that adding another level of expansion:
>      localedir=`eval echo "${localedir}"`
>  fixes the problem.

First, Autoconf is supposed to warn about the suspicious usage of
datadir without defining datarootdir.  Did the warning not work for
you?  If so, can you show us how to reproduce the problem easily?

Second, that promiscuous 'eval' can lead to trouble.  First, it
assumes that exactly one level of indirection will be right, which is
not portable to future versions of Autoconf.  Second, if localedir
contains special characters they can cause arbitrary shell code to be
executed.

Something like this code (which I haven't tested) would be safer:

for i in . . . . . . . . . . . . X; do
  test $i = X && AC_MSG_ERROR([too many levels of indirection in localedir])
  case $localedir in
    *'"'* | *'`'* | *'\'* | *'$('*)
      AC_MSG_ERROR([invalid character sequence in localedir]);;
    *\$*) eval "localedir=\"$localedir\"" ||
      AC_MSG_ERROR([invalid variable in localedir]);;
    *) break;;
  esac
done

Kind of a hassle, huh?  But this sort of hassle is inevitable once you
start using 'eval' with uncontrolled input.