Skip to content

Dependabot issue in remove_dir_all #31

@torhovland

Description

@torhovland

ya-gcp v0.9.0 depends on tempdir v0.3.7, which depends on remove_dir_all v0.5.3. This crate is triggering the following Dependabot issue:

Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all

Upgrade remove_dir_all to version 0.8.0 or later. For example:

[dependencies]
remove_dir_all = "0.8.0"
[dev-dependencies]
remove_dir_all = "0.8.0"

The remove_dir_all crate is a Rust library that offers additional features over the Rust standard library fs::remove_dir_all function. It suffers the same class of failure as the code it was layering over: TOCTOU race conditions, with the ability to cause arbitrary paths to be deleted by substituting a symlink for a path after the type of the path was checked.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions