Summary

Should find-dynamic-extension unconditionally look in .?

Metadata

• Id: 190c189ce3299eb1922b7a64553d9ca86449df78
• Trac id:
• Type: defect
• Reporter: felix
• Owner: felix
• Cc:
• Status: accepted
• Component: core libraries
• Estimated difficulty: medium
• Resolution:
• Priority: minor
• Milestone:
• Version: 6.0.0
• Changetime: 2026-08-24 20:08:59 UTC
• Created: 2026-08-23 13:09:44 UTC
• Keywords:

Description

(reported by Daniel Colascione:)

find-dynamic-extension in eval.scm looks like this

 (let loop ((paths
             (##sys#append
              (if ##sys#setup-mode '(".") '())
              (or rp '())
              (if inc? ##sys#include-pathnames '())
              (if ##sys#setup-mode '() '(".")))))

So no matter what I do at user level, I can't get "." off the search path for dynamically-loaded code. Loading code from CWD is a well-known security footgun.

Could this inclusion of "." be suppressed somehow, or, ideally, not done by default?

Changes and comments

[2026-08-23 22:34:41 UTC] felix set owner to felix

[2026-08-23 22:34:41 UTC] felix changed status from new to accepted

[2026-08-24 20:08:59 UTC] felix changed owner from felix to felix

[2026-08-24 20:08:59 UTC] felix changed status from accepted to accepted