merge revision(s) 30905:

	* lib/fileutils.rb (FileUtils::remove_entry_secure): there is a
	  race condition in the case where the given path is a directory,
	  and some other user can move that directory, and create a
	  symlink while this method is executing.
	  Reported by: Nicholas Jefferson <nicholas at pythonic.com.au>


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8_7@30910 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

3 files changed, 18 insertions, 5 deletions

diff --git a/ChangeLog b/ChangeLog
index 341d69a89f..061fcd13c3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+Fri Feb 18 21:17:22 2011  Shugo Maeda  <shugo@ruby-lang.org>
+
+	* lib/fileutils.rb (FileUtils::remove_entry_secure): there is a
+	  race condition in the case where the given path is a directory,
+	  and some other user can move that directory, and create a
+	  symlink while this method is executing.
+	  Reported by: Nicholas Jefferson <nicholas at pythonic.com.au>
+
 Fri Feb 18 19:46:46 2011  NAKAMURA Usaku  <usa@ruby-lang.org>
 
 	* win32/win32.c (init_stdhandle): backport mistake of r29382.
diff --git a/lib/fileutils.rb b/lib/fileutils.rb
index d6b6cd2d7a..9b759c079d 100644
--- a/lib/fileutils.rb
+++ b/lib/fileutils.rb
@@ -658,10 +658,10 @@ module FileUtils
   # removing directories.  This requires the current process is the
   # owner of the removing whole directory tree, or is the super user (root).
   #
-  # WARNING: You must ensure that *ALL* parent directories are not
-  # world writable.  Otherwise this method does not work.
-  # Only exception is temporary directory like /tmp and /var/tmp,
-  # whose permission is 1777.
+  # WARNING: You must ensure that *ALL* parent directories cannot be
+  # moved by other untrusted users.  For example, parent directories
+  # should not be owned by untrusted users, and should not be world
+  # writable except when the sticky bit set.
   #
   # WARNING: Only the owner of the removing directory tree, or Unix super
   # user (root) should invoke this method.  Otherwise this method does not
@@ -704,6 +704,11 @@ module FileUtils
       end
       f.chown euid, -1
       f.chmod 0700
+      unless fu_stat_identical_entry?(st, File.lstat(fullpath))
+        # TOC-to-TOU attack?
+        File.unlink fullpath
+        return
+      end
     }
     # ---- tree root is frozen ----
     root = Entry_.new(path)
diff --git a/version.h b/version.h
index 777b674e4b..44e5318ba2 100644
--- a/version.h
+++ b/version.h
@@ -2,7 +2,7 @@
 #define RUBY_RELEASE_DATE "2011-02-18"
 #define RUBY_VERSION_CODE 187
 #define RUBY_RELEASE_CODE 20110218
-#define RUBY_PATCHLEVEL 332
+#define RUBY_PATCHLEVEL 333
 
 #define RUBY_VERSION_MAJOR 1
 #define RUBY_VERSION_MINOR 8