Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

merge revision(s) 30905:

	* lib/fileutils.rb (FileUtils::remove_entry_secure): there is a
	  race condition in the case where the given path is a directory,
	  and some other user can move that directory, and create a
	  symlink while this method is executing.
	  Reported by: Nicholas Jefferson <nicholas at pythonic.com.au>


git-svn-id: http://svn.ruby-lang.org/repos/ruby/branches/ruby_1_8_7@30910 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
  • Loading branch information...
commit aa436a23812b4e2cfd351acfc9a86fc8ccce3970 1 parent cc57116
@shyouhei shyouhei authored
Showing with 18 additions and 5 deletions.
  1. +8 −0 ChangeLog
  2. +9 −4 lib/fileutils.rb
  3. +1 −1  version.h
View
8 ChangeLog
@@ -1,3 +1,11 @@
+Fri Feb 18 21:17:22 2011 Shugo Maeda <shugo@ruby-lang.org>
+
+ * lib/fileutils.rb (FileUtils::remove_entry_secure): there is a
+ race condition in the case where the given path is a directory,
+ and some other user can move that directory, and create a
+ symlink while this method is executing.
+ Reported by: Nicholas Jefferson <nicholas at pythonic.com.au>
+
Fri Feb 18 19:46:46 2011 NAKAMURA Usaku <usa@ruby-lang.org>
* win32/win32.c (init_stdhandle): backport mistake of r29382.
View
13 lib/fileutils.rb
@@ -658,10 +658,10 @@ def rm_rf(list, options = {})
# removing directories. This requires the current process is the
# owner of the removing whole directory tree, or is the super user (root).
#
- # WARNING: You must ensure that *ALL* parent directories are not
- # world writable. Otherwise this method does not work.
- # Only exception is temporary directory like /tmp and /var/tmp,
- # whose permission is 1777.
+ # WARNING: You must ensure that *ALL* parent directories cannot be
+ # moved by other untrusted users. For example, parent directories
+ # should not be owned by untrusted users, and should not be world
+ # writable except when the sticky bit set.
#
# WARNING: Only the owner of the removing directory tree, or Unix super
# user (root) should invoke this method. Otherwise this method does not
@@ -704,6 +704,11 @@ def remove_entry_secure(path, force = false)
end
f.chown euid, -1
f.chmod 0700
+ unless fu_stat_identical_entry?(st, File.lstat(fullpath))
+ # TOC-to-TOU attack?
+ File.unlink fullpath
+ return
+ end
}
# ---- tree root is frozen ----
root = Entry_.new(path)
View
2  version.h
@@ -2,7 +2,7 @@
#define RUBY_RELEASE_DATE "2011-02-18"
#define RUBY_VERSION_CODE 187
#define RUBY_RELEASE_CODE 20110218
-#define RUBY_PATCHLEVEL 332
+#define RUBY_PATCHLEVEL 333
#define RUBY_VERSION_MAJOR 1
#define RUBY_VERSION_MINOR 8
Please sign in to comment.
Something went wrong with that request. Please try again.