http://d.puremagic.com/issues/show_bug.cgi?id=11365

           Summary: Allow D source file names to have no extension
           Product: D
           Version: D2
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: enhancement
          Priority: P2
         Component: DMD
        AssignedTo: nobody@puremagic.com
        ReportedBy: bugzilla@digitalmars.com


--- Comment #0 from Walter Bright <bugzilla@digitalmars.com> 2013-10-26 14:10:21 PDT ---
---- eles writes ----
This forces scripts to bear the .d extension. For example, if you write a script on Linux named "git-test" and you put at the top:

#!rdmd

rdmd will pass its name to dmd, and dmd will try to compile... "git-test.d", which does not exist.

Now, you have either to rename the "git-test" into "git-test.d", or to create a hardlink named "git-test.d" that points towards "git-test" so that dmd finally gets satisfied its ".d" hungriness.

The solution with the hardlink carries the well-known burden of redundancy, let's not even say its idiot and makes back-up-ing a mess.

OTOH, renaming the original script into "git-test.d" has the undesirable effect wrt to git software.

git uses some nice convention that you can extend its command list by writing your own "git-command1", "git-command2" scripts and they are invoked automatically by git when you type:

"git command1" (this will invoke "git-command1") etc.

The problem with being forced to rename "git-command1" into "git-command1.d" is that, afterwards, you have to type the following command for git:

"git command1.d" (in order to have the "git-command1.d" invoked, as "git-command1" simply does not exist or, if it would exist, dmd would be blind about it).

SO, you cannot type "git command1" and to have a "git-command1" script invoked, because git won't search for "git-command1.d", while dmd won't compile "git-command1".

So you need both "git-command1" and "git-command1.d" doing the same thing, just to be able to type "git command1" (not even say that this allows you to invoke, also "git comman1.d", which is ugly and undesired redundancy).

Now, immagine yourself having to type:

"git checkout.d ."
"git commit.d"
"git log.d"

instead of

"git checkout ."
"git commit"
"git log"

and tell me that ".d" is not an issue.
----------------------

To that end, I propose that for:

    dmd foo

that it will treat 'foo' as the source file if it does not find foo.d or foo.di.

-- 
Configure issuemail: http://d.puremagic.com/issues/userprefs.cgi?tab=email
------- You are receiving this mail because: -------

http://d.puremagic.com/issues/show_bug.cgi?id=11365


Vladimir Panteleev <thecybershadow@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |thecybershadow@gmail.com


--- Comment #1 from Vladimir Panteleev <thecybershadow@gmail.com> 2013-10-27 01:04:00 EEST ---
I should note that "auto-correcting" file names has security implications.

Let's suppose that there exists an upload script file, written in D, called "upload", in the root of a web server's public directory. The upload script goes like this:

#!rdmd
(code follows)

The upload script allows users to upload files with any name to the same directory. Naturally, for security reasons, none of the uploaded files can be executable, and it's not possible to overwrite the upload script by uploading a file with the same name.

Now, what happens if someone uploads a file called "upload.d"?

The webserver runs "upload", which runs "rdmd upload", which runs "dmd upload", which compiles teh file "upload.d", and not "upload". The uploader successfully got their code running on the server.

Possible solutions:
1) deprecate then remove all name auto-correction features from dmd and rdmd
2) forbid compilation if an ambiguity exists due to name auto-correction
(although now this turns from an RCE vulnerability into a DOS vulnerability)
3) remove auto-correction features from rdmd; make rdmd pass a flag to dmd that
disable name auto-correction

---------------------------------------------------

Another problem with this suggestion:

echo 'void main(){}' > foo.d
dmd foo
rm foo.d
dmd foo

dmd will now try to parse a compiled binary file as an executable.

-- 
Configure issuemail: http://d.puremagic.com/issues/userprefs.cgi?tab=email
------- You are receiving this mail because: -------

http://d.puremagic.com/issues/show_bug.cgi?id=11365



--- Comment #2 from Vladimir Panteleev <thecybershadow@gmail.com> 2013-10-27 01:06:08 EEST ---
One thing I forgot to mention regarding name auto-correction. Perhaps, the most famous security problem caused by such a mis-feature, is the "MultiViews" feature in the Apache web server. When enabled, a request for foo.php could execute foo.php.txt if foo.php was not found. This allowed bypassing upload script validation checks. Search the web for "MultiViews vulnerability" for more details.

-- 
Configure issuemail: http://d.puremagic.com/issues/userprefs.cgi?tab=email
------- You are receiving this mail because: -------

http://d.puremagic.com/issues/show_bug.cgi?id=11365


Jacob Carlborg <doob@me.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |doob@me.com


--- Comment #3 from Jacob Carlborg <doob@me.com> 2013-10-27 03:12:32 PDT ---
(In reply to comment #1)

> 3) remove auto-correction features from rdmd; make rdmd pass a flag to dmd that disable name auto-correction

That won't fix the problem if one is using "dmd -run".

-- 
Configure issuemail: http://d.puremagic.com/issues/userprefs.cgi?tab=email
------- You are receiving this mail because: -------

http://d.puremagic.com/issues/show_bug.cgi?id=11365


Leandro Lucarella <leandro.lucarella@sociomantic.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |leandro.lucarella@sociomant
                   |                            |ic.com
            Summary|Allow D source file names   |Allow D source file names
                   |to have no extension        |to have no extension (or an
                   |                            |arbitrary extension)


--- Comment #4 from Leandro Lucarella <leandro.lucarella@sociomantic.com> 2013-10-27 05:05:52 PDT ---
I just updated the title of the issue, arbitrary extension names should be allowed for the same reason. I also agree with Vladimir, the compiler shouldn't add any extension when the file is not found.

-- 
Configure issuemail: http://d.puremagic.com/issues/userprefs.cgi?tab=email
------- You are receiving this mail because: -------

http://d.puremagic.com/issues/show_bug.cgi?id=11365


Andrej Mitrovic <andrej.mitrovich@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |andrej.mitrovich@gmail.com


--- Comment #5 from Andrej Mitrovic <andrej.mitrovich@gmail.com> 2013-10-30 08:34:33 PDT ---
Btw, no extensions might be fine, but I'm totally against D sources having arbitrary extensions. People will start doing the same thing C++ programmers do and start inventing 20 different extensions for D sources, so you end up with extensions like:

.cpp
.cxx
.cp
.cc
.c++

See also: http://gcc.gnu.org/onlinedocs/gcc-4.8.2/gcc/Overall-Options.html

This would just make creating software that deals with D files harder, with no benefits.

-- 
Configure issuemail: http://d.puremagic.com/issues/userprefs.cgi?tab=email
------- You are receiving this mail because: -------

http://d.puremagic.com/issues/show_bug.cgi?id=11365



--- Comment #6 from Andrej Mitrovic <andrej.mitrovich@gmail.com> 2013-10-30 08:36:07 PDT ---
(In reply to comment #4)
> I just updated the title of the issue, arbitrary extension names should be allowed for the same reason.

So you're the one adding this. What benefit do you see with arbitrary extensions?

-- 
Configure issuemail: http://d.puremagic.com/issues/userprefs.cgi?tab=email
------- You are receiving this mail because: -------

http://d.puremagic.com/issues/show_bug.cgi?id=11365



--- Comment #7 from Leandro Lucarella <leandro.lucarella@sociomantic.com> 2013-10-30 08:41:42 PDT ---
(In reply to comment #6)
> (In reply to comment #4)
> > I just updated the title of the issue, arbitrary extension names should be allowed for the same reason.
> 
> So you're the one adding this. What benefit do you see with arbitrary extensions?

First, it worth mention that the extension problem with C++ only happened to C++ for historical reasons. There is no reason to think it will happen to D as it doesn't happen in any other language that is flexible in terms of naming files.

The reason of having an arbitrary file NAME (the extension is just an artificial separation of a file name) is the same mentioned in the issue description. The compiler have no reason to limit how can I name files. Why if I want to create a script that's called "dlang.org". For some reason I might have a system to fetch stuff from websites and call the scripts after the host name.

The moment D tries to pretend it can be used for scripting is the moment D lost its right to place limitations on file naming. Is that simple.

-- 
Configure issuemail: http://d.puremagic.com/issues/userprefs.cgi?tab=email
------- You are receiving this mail because: -------

http://d.puremagic.com/issues/show_bug.cgi?id=11365


bearophile_hugs@eml.cc changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bearophile_hugs@eml.cc


--- Comment #8 from bearophile_hugs@eml.cc 2013-10-30 08:53:19 PDT ---
(In reply to comment #5)
> Btw, no extensions might be fine, but I'm totally against D sources having arbitrary extensions. People will start doing the same thing C++ programmers do and start inventing 20 different extensions for D sources, so you end up with extensions like:
> 
> .cpp
> .cxx
> .cp
> .cc
> .c++

+1.

If you offer programmers some freedom, someone will inevitably use it, often with chaotic/confusing results (I see it every day in D.learn). Giving freedom should be done only where there is a large advantage of doing it.

-- 
Configure issuemail: http://d.puremagic.com/issues/userprefs.cgi?tab=email
------- You are receiving this mail because: -------

http://d.puremagic.com/issues/show_bug.cgi?id=11365



--- Comment #9 from bearophile_hugs@eml.cc 2013-10-31 07:42:41 PDT ---
Having a standard extension for D code is useful for programs like "cloc" that count lines of code, with editors that open .d files with correct D colorization, for my scripts that select files with .d suffix to test incompatibilities across different compiler versions. I have testing scripts that test .d files differently from .py files looking in directories. And it's not just a matter of my own code, it also mattes from D libraries from other people.

-- 
Configure issuemail: http://d.puremagic.com/issues/userprefs.cgi?tab=email
------- You are receiving this mail because: -------