Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependabot issue in remove_dir_all #31

Open
torhovland opened this issue May 2, 2023 · 0 comments
Open

Dependabot issue in remove_dir_all #31

torhovland opened this issue May 2, 2023 · 0 comments

Comments

@torhovland
Copy link

ya-gcp v0.9.0 depends on tempdir v0.3.7, which depends on remove_dir_all v0.5.3. This crate is triggering the following Dependabot issue:

Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all

Upgrade remove_dir_all to version 0.8.0 or later. For example:

[dependencies]
remove_dir_all = "0.8.0"
[dev-dependencies]
remove_dir_all = "0.8.0"

The remove_dir_all crate is a Rust library that offers additional features over the Rust standard library fs::remove_dir_all function. It suffers the same class of failure as the code it was layering over: TOCTOU race conditions, with the ability to cause arbitrary paths to be deleted by substituting a symlink for a path after the type of the path was checked.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant