summaryrefslogtreecommitdiff
path: root/lib/fileutils.rb
diff options
context:
space:
mode:
authorshyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2011-02-18 10:42:50 +0000
committershyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2011-02-18 10:42:50 +0000
commitc1afbd39e1769d705dcbf08482f91c1e6c939e8f (patch)
tree4ddbd3fbe4dc0d92f08a0889b7ca3f72316690ec /lib/fileutils.rb
parent80466e3fc7c136bada2b8b0321d0e0104b2890f0 (diff)
* lib/fileutils.rb (FileUtils::remove_entry_secure): there is a
race condition in the case where the given path is a directory, and some other user can move that directory, and create a symlink while this method is executing. Reported by: Nicholas Jefferson <nicholas at pythonic.com.au> git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@30896 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'lib/fileutils.rb')
-rw-r--r--lib/fileutils.rb13
1 files changed, 9 insertions, 4 deletions
diff --git a/lib/fileutils.rb b/lib/fileutils.rb
index 1023ae3063..9cd1a7cc76 100644
--- a/lib/fileutils.rb
+++ b/lib/fileutils.rb
@@ -667,10 +667,10 @@ module FileUtils
# removing directories. This requires the current process is the
# owner of the removing whole directory tree, or is the super user (root).
#
- # WARNING: You must ensure that *ALL* parent directories are not
- # world writable. Otherwise this method does not work.
- # Only exception is temporary directory like /tmp and /var/tmp,
- # whose permission is 1777.
+ # WARNING: You must ensure that *ALL* parent directories cannot be
+ # moved by other untrusted users. For example, parent directories
+ # should not be owned by untrusted users, and should not be world
+ # writable except when the sticky bit set.
#
# WARNING: Only the owner of the removing directory tree, or Unix super
# user (root) should invoke this method. Otherwise this method does not
@@ -713,6 +713,11 @@ module FileUtils
end
f.chown euid, -1
f.chmod 0700
+ unless fu_stat_identical_entry?(st, File.lstat(fullpath))
+ # TOC-to-TOU attack?
+ File.unlink fullpath
+ return
+ end
}
# ---- tree root is frozen ----
root = Entry_.new(path)