libexpr: fix checkSourcePath purity regression

Starting with commit 0dbfa7b26e access would also
be allowed to ancestors of allowed paths. This is (ironically) a significant
purity regression, since several users of the purity checks will themselves
assume that arbitrary descent is allowed. For example, `builtins.readDir` and
`builtins.path` could now refer to the filesystem root, breaking purity
entirely in the latter case by allowing to read arbitrary files. Restore the
previous behaviour of only allowing access to explicitly allowed paths.

Change-Id: Ie64180733ab735da9873255e1ccbf95ba7c9161c

doc/manual/rl-next/checkSourcePath-purity-regression.md

@@ -0,0 +1,15 @@
+---
+synopsis: Forbid impure path accesses in pure evaluation mode again
+category: Fixes
+cls: [2708]
+credits: [alois31]
+---
+Lix 2.92.0 mistakenly started allowing the access to ancestors of allowed paths in pure evaluation mode.
+This made it possible to bypass the purity restrictions, for example by copying arbitrary files to the store:
+```nix
+builtins.path {
+  path = "/";
+  filter = …;
+}
+```
+Restore the previous behaviour of prohibiting such impure accesses.

lix/libexpr/eval.cc

@@ -464,6 +464,10 @@ retry:
         }
         current = std::move(next);
     }
+    // Downstream users (e.g. `builtins.readDir` or `builtins.path`) will want to descend.
+    if (level && !level->allowAllChildren) {
+        goto failed;
+    }
 
     resolvedPaths.insert_or_assign(path_.canonical().abs(), current);
     return current;

tests/functional/pure-eval.sh

@@ -18,6 +18,7 @@ echo "$missingImpureErrorMsg" | grepQuiet -- --impure || \
 (! nix eval --expr builtins.currentSystem)
 
 (! nix-instantiate --pure-eval ./simple.nix)
+(! nix eval --expr 'builtins.readDir "/"')
 
 [[ $(nix eval --impure --expr "(import (builtins.fetchurl { url = \"file://$(pwd)/pure-eval.nix\"; })).x") == 123 ]]
 (! nix eval --expr "(import (builtins.fetchurl { url = \"file://$(pwd)/pure-eval.nix\"; })).x")