[issue4489] shutil.rmtree is vulnerable to a symlink attack
report at bugs.python.org
Wed Jan 5 16:21:18 CET 2011
Antoine Pitrou <pitrou at free.fr> added the comment:
Thanks for the patch.
There seems to be a race remaining here:
+ if os.path.islink(path):
+ # symlinks to directories are forbidden, see bug #1669
+ raise OSError("Cannot call rmtree on a symbolic link")
+ except OSError:
+ onerror(os.path.islink, path, sys.exc_info())
+ # can't continue even if onerror hook returns
+ fd = os.open(path, os.O_RDONLY)
Someone could change `path` to be a symlink between the calls to islink() and open(). You probably need to stat the fd instead.
Some other things:
- if close() is meant to be a private helper, it should be named _close()
- instead of a bare "except" in close(), use "except EnvironmentError" or "except OSError"
I haven't looked at the tests yet.
stage: needs patch -> patch review
versions: -Python 2.5, Python 2.6, Python 2.7, Python 3.1, Python 3.2
Python tracker <report at bugs.python.org>
More information about the Python-bugs-list