Skip to content
  • Rufflewind's avatar
    Fix TOCTOU issue with recursive removal on POSIX systems · 14f5851f
    Rufflewind authored
    removeDirectoryRecursive and removePathForcibly are supposed to never
    traverse symbolic links, which would avoid unintended deletion of files
    outside the specified directory tree.
    
    The previous implementation did not "lock onto" the directory while
    enumerating its entries, allowing concurrent processes to replace the
    directory with a symlink right before or during the enumeration and
    tricking the deleter into traversing the symlink (#97).
    
    This commit mitigates the issue on POSIX systems by acquiring file
    descriptors to every directory it traverses.
    14f5851f
To find the state of this project's repository at the time of any of these versions, check out the tags.