Skip to content

Commit

Permalink
Use #rm_rf rather than #remove_entry_secure
Browse files Browse the repository at this point in the history
On some systems, `FileUtils#remove_entry_secure` fails to work because
it fails the [TOCTTOU vulnerability check](1), even for `/tmp`. In the
case of nanoc, the vulnerability check has little use, since it deletes
the directories that it creates itself, so using `FileUtils#rm_rf`
instead of `FileUtils#remove_entry_secure` is fine.

Also see #465

[1]: http://www.ruby-doc.org/stdlib-2.1.2/libdoc/fileutils/rdoc/FileUtils.html#method-c-remove_entry_secure
  • Loading branch information
denisdefreyne committed Sep 6, 2014
1 parent a442c7a commit ff596cd
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions lib/nanoc/base/temp_filename_factory.rb
Expand Up @@ -42,13 +42,13 @@ def create(prefix)
def cleanup(prefix)
path = File.join(@root_dir, prefix)
if File.exist?(path)
FileUtils.remove_entry_secure(path)
FileUtils.rm_rf(path)
end

@counts.delete(prefix)

if @counts.empty? && File.directory?(@root_dir)
FileUtils.remove_entry_secure(@root_dir)
FileUtils.rm_rf(@root_dir)
end
end

Expand Down

0 comments on commit ff596cd

Please sign in to comment.