Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ensure that tempdirs are removed in Perl 5.28. #647

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from

Conversation

jkeenan
Copy link

@jkeenan jkeenan commented Aug 14, 2017

File::Temp::tempdir() internally calls File::Path::rmtree() to implement the
'CLEANUP => 1' option. A security vulnernability was discovered in rmtree()
in early 2017. This vulnerability has been addressed in File::Path versions
2.14 and later; a thus patched version of File::Path will appear in Perl-5.28
to be released in spring 2018.

The security correction changes the functionality of rmtree() when not called
with a true value as its third positional argument:

rmtree($my_tempdir, 0, 0);

As of File::Path 2.14, this syntax will no longer remove directories for which
the user lacks both 'read' and 'execute' permissions. For example, any
directory whose numerical permissions are octal 0000 or 0200 will no longer be
deleted.

The file for which this patch is being submitted contains a chmod() call with
0000 permissions. While, even if this patch is not applied, all tests in the
file will continue to PASS, the 0000 directories will not be deleted and the
person running the test will be shown warnings that some directories have not
been deleted. The patch attached addresses this situation by restoring owner
'read' and 'execute' permissions to the directory before the call to tempdir()
goes out of scope. This will once again remove the tempdirs, eliminate the
warnings and avert user confusion.

File::Temp::tempdir() internally calls File::Path::rmtree() to implement the
'CLEANUP => 1' option.  A security vulnernability was discovered in rmtree()
in early 2017.  This vulnerability has been addressed in File::Path versions
2.14 and later; a thus patched version of File::Path will appear in Perl-5.28
to be released in spring 2018.

The security correction changes the functionality of rmtree() when not called
with a true value as its third positional argument:

    rmtree($my_tempdir, 0, 0);

As of File::Path 2.14, this syntax will no longer remove directories for which
the user lacks both 'read' and 'execute' permissions.  For example, any
directory whose numerical permissions are octal 0000 or 0200 will no longer be
deleted.

The file for which this patch is being submitted contains a chmod() call with
0000 permissions.  While, even if this patch is not applied, all tests in the
file will continue to PASS, the 0000 directories will not be deleted and the
person running the test will be shown warnings that some directories have not
been deleted.  The patch attached addresses this situation by restoring owner
'read' and 'execute' permissions to the directory before the call to tempdir()
goes out of scope.  This will once again remove the tempdirs, eliminate the
warnings and avert user confusion.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant