diff options
-rw-r--r-- | ChangeLog | 8 | ||||
-rw-r--r-- | lib/fileutils.rb | 13 | ||||
-rw-r--r-- | version.h | 10 |
3 files changed, 22 insertions, 9 deletions
@@ -1,3 +1,11 @@ +Fri Feb 18 19:31:31 2011 Shugo Maeda <shugo@ruby-lang.org> + + * lib/fileutils.rb (FileUtils::remove_entry_secure): there is a + race condition in the case where the given path is a directory, + and some other user can move that directory, and create a + symlink while this method is executing. + Reported by: Nicholas Jefferson <nicholas at pythonic.com.au> + Sun Aug 15 19:59:58 2010 Yuki Sonoda (Yugui) <yugui@yugui.jp> * lib/webrick/httpresponse.rb (WEBrick::HTTPResponse#set_error): diff --git a/lib/fileutils.rb b/lib/fileutils.rb index 0a3fdc41db..6cb0d14b6b 100644 --- a/lib/fileutils.rb +++ b/lib/fileutils.rb @@ -665,10 +665,10 @@ module FileUtils # removing directories. This requires the current process is the # owner of the removing whole directory tree, or is the super user (root). # - # WARNING: You must ensure that *ALL* parent directories are not - # world writable. Otherwise this method does not work. - # Only exception is temporary directory like /tmp and /var/tmp, - # whose permission is 1777. + # WARNING: You must ensure that *ALL* parent directories cannot be + # moved by other untrusted users. For example, parent directories + # should not be owned by untrusted users, and should not be world + # writable except when the sticky bit set. # # WARNING: Only the owner of the removing directory tree, or Unix super # user (root) should invoke this method. Otherwise this method does not @@ -711,6 +711,11 @@ module FileUtils end f.chown euid, -1 f.chmod 0700 + unless fu_stat_identical_entry?(st, File.lstat(fullpath)) + # TOC-to-TOU attack? + File.unlink fullpath + return + end } # ---- tree root is frozen ---- root = Entry_.new(path) @@ -1,13 +1,13 @@ #define RUBY_VERSION "1.9.1" -#define RUBY_PATCHLEVEL 430 +#define RUBY_PATCHLEVEL 431 #define RUBY_VERSION_MAJOR 1 #define RUBY_VERSION_MINOR 9 #define RUBY_VERSION_TEENY 1 -#define RUBY_RELEASE_YEAR 2010 -#define RUBY_RELEASE_MONTH 8 -#define RUBY_RELEASE_DAY 16 -#define RUBY_RELEASE_DATE "2010-08-16" +#define RUBY_RELEASE_YEAR 2011 +#define RUBY_RELEASE_MONTH 2 +#define RUBY_RELEASE_DAY 18 +#define RUBY_RELEASE_DATE "2011-02-18" #ifdef RUBY_EXTERN RUBY_EXTERN const char ruby_version[]; |