* lib/fileutils.rb (mkdir, mkdir_p): should ensure directory permission. (backportted from HEAD, 1.47)

* lib/fileutils.rb (traverse, remove_dir): untaint trasted objects. (backportted from HEAD, 1.46)


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8@7654 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

2 files changed, 25 insertions, 9 deletions

diff --git a/ChangeLog b/ChangeLog
index 5929e7ac56..0213a52bb8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+Sat Dec 25 04:23:49 2004  Minero Aoki  <aamine@loveruby.net>
+
+	* lib/fileutils.rb (mkdir, mkdir_p): should ensure directory
+	  permission. (backportted from HEAD, 1.47)
+
+	* lib/fileutils.rb (traverse, remove_dir): untaint trasted
+	  objects. (backportted from HEAD, 1.46)
+
 Fri Dec 24 23:51:48 2004  Hirokazu Yamamoto  <ocean@m2.ccsnet.ne.jp>
 
 	* bcc32/Makefile.sub: bcc32 should use RTL dll (backport from HEAD)
diff --git a/lib/fileutils.rb b/lib/fileutils.rb
index d92e4c3c94..dbf993d2e9 100644
--- a/lib/fileutils.rb
+++ b/lib/fileutils.rb
@@ -73,7 +73,6 @@
 # <tt>:verbose</tt> flags to methods in FileUtils.
 # 
 
-
 module FileUtils
 
   # All methods are module_function.
@@ -148,9 +147,8 @@ module FileUtils
     fu_output_message "mkdir #{options[:mode] ? ('-m %03o ' % options[:mode]) : ''}#{list.join ' '}" if options[:verbose]
     return if options[:noop]
 
-    mode = options[:mode] || (0777 & ~File.umask)
     list.each do |dir|
-      Dir.mkdir dir.sub(%r</\z>, ''), mode
+      fu_mkdir dir, options[:mode]
     end
   end
 
@@ -176,11 +174,10 @@ module FileUtils
     fu_output_message "mkdir -p #{options[:mode] ? ('-m %03o ' % options[:mode]) : ''}#{list.join ' '}" if options[:verbose]
     return *list if options[:noop]
 
-    mode = options[:mode] || (0777 & ~File.umask)
     list.map {|path| path.sub(%r</\z>, '') }.each do |path|
       # optimize for the most common case
       begin
-        Dir.mkdir path, mode
+        fu_mkdir path, options[:mode]
         next
       rescue SystemCallError
         next if File.directory?(path)
@@ -193,7 +190,7 @@ module FileUtils
       end
       stack.reverse_each do |path|
         begin
-          Dir.mkdir path, mode
+          fu_mkdir path, options[:mode]
         rescue SystemCallError => err
           raise unless File.directory?(path)
         end
@@ -206,6 +203,17 @@ module FileUtils
   alias mkpath    mkdir_p
   alias makedirs  mkdir_p
 
+  def fu_mkdir(path, mode)
+    path = path.sub(%r</\z>, '')
+    if mode
+      Dir.mkdir path, mode
+      File.chmod mode, path
+    else
+      Dir.mkdir path
+    end
+  end
+  private :fu_mkdir
+
 
   #
   # Options: noop, verbose
@@ -385,7 +393,7 @@ module FileUtils
       if st.directory? and (deref or not st.symlink?)
         stack.concat Dir.entries("#{prefix}/#{rel}")\
                          .reject {|ent| ent == '.' or ent == '..' }\
-                         .map {|ent| "#{rel}/#{ent}" }.reverse
+                         .map {|ent| "#{rel}/#{ent.untaint}" }.reverse
       end
       yield rel, deref, st
       deref = false
@@ -692,8 +700,8 @@ module FileUtils
 
   def remove_dir(dir, force = false) #:nodoc:
     Dir.foreach(dir) do |file|
-      next if /\A\.\.?\z/ === file
-      path = "#{dir}/#{file}"
+      next if /\A\.\.?\z/ =~ file
+      path = "#{dir}/#{file.untaint}"
       if File.symlink?(path)
         remove_file path, force
       elsif File.directory?(path)