getDefaultNixPath: actually respect {restrict,pure}-eval

Previously, getDefaultNixPath was called too early: at initialisation
time, before CLI and config have been processed, when `restrictEval` and
`pureEval` both have their default value `false`. Call it when
initialising the EvalState instead, and use `setDefault`.

src/libexpr/eval.cc

@@ -519,6 +519,7 @@ EvalState::EvalState(
  static_assert(sizeof(Env) <= 16, "environment must be <= 16 bytes");
 
  /* Initialise the Nix expression search path. */
+ evalSettings.nixPath.setDefault(evalSettings.getDefaultNixPath());
  if (!evalSettings.pureEval) {
  for (auto & i : _searchPath) addToSearchPath(i);
  for (auto & i : evalSettings.nixPath.get()) addToSearchPath(i);
@@ -2472,30 +2473,35 @@ std::ostream & operator << (std::ostream & str, const ExternalValueBase & v) {
 
 EvalSettings::EvalSettings()
 {
- auto var = getEnv("NIX_PATH");
- if (var) nixPath = parseNixPath(*var);
 }
 
+/* impure => NIX_PATH or a default path
+ * restrict-eval => NIX_PATH
+ * pure-eval => empty
+ */
 Strings EvalSettings::getDefaultNixPath()
 {
- Strings res;
- auto add = [&](const Path & p, const std::string & s = std::string()) {
- if (pathExists(p)) {
- if (s.empty()) {
- res.push_back(p);
- } else {
- res.push_back(s + "=" + p);
- }
- }
- };
+ if (pureEval)
+ return {};
+
+ auto var = getEnv("NIX_PATH");
+ if (var) {
+ return parseNixPath(*var);
+ } else if (restrictEval) {
+ return {};
+ } else {
+ Strings res;
+ auto add = [&](const Path & p, const std::optional<std::string> & s = std::nullopt) {
+ if (pathExists(p))
+ res.push_back(s ? *s + "=" + p : p);
+ };
 
- if (!evalSettings.restrictEval && !evalSettings.pureEval) {
  add(getHome() + "/.nix-defexpr/channels");
  add(settings.nixStateDir + "/profiles/per-user/root/channels/nixpkgs", "nixpkgs");
  add(settings.nixStateDir + "/profiles/per-user/root/channels");
- }
 
- return res;
+ return res;
+ }
 }
 
 bool EvalSettings::isPseudoUrl(std::string_view s)

src/libexpr/eval.hh

@@ -570,7 +570,7 @@ struct EvalSettings : Config
 {
  EvalSettings();
 
- static Strings getDefaultNixPath();
+ Strings getDefaultNixPath();
 
  static bool isPseudoUrl(std::string_view s);
 
@@ -580,7 +580,7 @@ struct EvalSettings : Config
  "Whether builtin functions that allow executing native code should be enabled."};
 
  Setting<Strings> nixPath{
- this, getDefaultNixPath(), "nix-path",
+ this, {}, "nix-path",
  "List of directories to be searched for `<...>` file references."};
 
  Setting<bool> restrictEval{

tests/nix_path.sh

@@ -12,3 +12,8 @@ nix-instantiate --eval -E '<by-relative-path/simple.nix>' --restrict-eval
 
 [[ $(nix-instantiate --find-file by-absolute-path/simple.nix) = $PWD/simple.nix ]]
 [[ $(nix-instantiate --find-file by-relative-path/simple.nix) = $PWD/simple.nix ]]
+
+unset NIX_PATH
+
+[[ $(nix-instantiate --option nix-path by-relative-path=. --find-file by-relative-path/simple.nix) = "$PWD/simple.nix" ]]
+[[ $(NIX_PATH= nix-instantiate --option nix-path by-relative-path=. --find-file by-relative-path/simple.nix) = "$PWD/simple.nix" ]]

tests/restricted.sh

@@ -17,6 +17,9 @@ nix-instantiate --restrict-eval --eval -E 'builtins.readDir ../src/nix-channel'
 (! nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in <foo>')
 nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in <foo>' -I src=.
 
+# no default NIX_PATH
+(unset NIX_PATH; ! nix-instantiate --restrict-eval --find-file .)
+
 p=$(nix eval --raw --expr "builtins.fetchurl file:https://$(pwd)/restricted.sh" --impure --restrict-eval --allowed-uris "file:https://$(pwd)")
 cmp $p restricted.sh