You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The remove_dir_all crate is a Rust library that offers additional features over the Rust standard library fs::remove_dir_all function. It suffers the same class of failure as the code it was layering over: TOCTOU race conditions, with the ability to cause arbitrary paths to be deleted by substituting a symlink for a path after the type of the path was checked.
The text was updated successfully, but these errors were encountered:
ya-gcp v0.9.0
depends ontempdir v0.3.7
, which depends onremove_dir_all v0.5.3
. This crate is triggering the following Dependabot issue:Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all
Upgrade remove_dir_all to version 0.8.0 or later. For example:
[dependencies]
remove_dir_all = "0.8.0"
[dev-dependencies]
remove_dir_all = "0.8.0"
The remove_dir_all crate is a Rust library that offers additional features over the Rust standard library fs::remove_dir_all function. It suffers the same class of failure as the code it was layering over: TOCTOU race conditions, with the ability to cause arbitrary paths to be deleted by substituting a symlink for a path after the type of the path was checked.
The text was updated successfully, but these errors were encountered: