cask: do not follow a symlinked rmdir path

[dduugg]

uninstall rmdir: and zap rmdir: paths come from the cask, so one can name a location that a local user is able to replace with a symlink. recursive_rmdir recursed through such a link and removed empty directories inside its target, and gain_permissions_rmdir then ran its chflags, chmod and sudo chown recovery round against the target too, because it passed no -h. The uninstall aborted afterwards with an uncaught Errno::ENOTDIR, so that path never removed anything successfully anyway.

Skipping symlinks in recursive_rmdir and always passing -h in gain_permissions_rmdir means a symlinked rmdir path can no longer redirect the privileged permission changes onto whatever it points at, and the abort becomes a clean "not empty" skip. -h needs no condition because it is a no-op on a real directory, so nothing is decided from a path that could change before the recovery runs. Real directories are unaffected.

This narrows the traversal rather than closing it: children and the per-directory rmdir can still be redirected if the path is swapped between the check and the use. Doing better needs descriptor-relative traversal with O_NOFOLLOW, which Ruby cannot express without FFI and which would replace recursive_rmdir rather than guard it. Before this change the link was followed on every run, so the window goes from certain to raced.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug? Reproducing needs a cask naming a path a second account can replace, covered by the added specs instead.
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

---

Claude Code with Opus 5, with local review and testing.

---

[MikeMcQuaid]

Thanks, one nit and then ready to self-merge!

[Copilot]

🟡 Changes recommended

Pathname checks remain vulnerable to races that can redirect traversal and privileged permission changes.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Hardens cask rmdir handling against symlink redirection.

Changes:

• Skips symlinks during recursive directory removal.
• Applies no-follow permission flags to symlink paths.
• Adds utility and zap regression tests.

File summaries

File	Description
Library/Homebrew/cask/utils.rb	Adds symlink-aware permission flags.
Library/Homebrew/cask/artifact/abstract_uninstall.rb	Skips symlinked directories.
Library/Homebrew/test/cask/utils_spec.rb	Tests permission recovery safety.
Library/Homebrew/test/cask/artifact/zap_spec.rb	Tests symlinked zap paths.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.