René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"shutil.rmtree is vulnerable to a symlink attack","articleBody":"BPO | [4489](https://bugs.python.org/issue4489)\n--- | :---\nNosy | @loewis, @birkenfeld, @jcea, @ncoghlan, @pitrou, @larryhastings, @blueyed, @tarekziade, @ezio-melotti, @merwok, @akheron, @hynek\nPRs | \u003cli\u003epython/cpython#22968\u003c/li\u003e\nDependencies | \u003cli\u003ebpo-4761: create Python wrappers for openat() and others\u003c/li\u003e\u003cli\u003ebpo-10755: Add posix.fdlistdir\u003c/li\u003e\u003cli\u003ebpo-13734: Add a generic directory walker method to avoid symlink attacks\u003c/li\u003e\u003cli\u003ebpo-14773: fwalk breaks on dangling symlinks\u003c/li\u003e\nFiles | \u003cli\u003e[shutil_patched.py](https://bugs.python.org/file12482/shutil_patched.py \"Uploaded as text/plain at 2008-12-29.08:22:51 by mrts\")\u003c/li\u003e\u003cli\u003e[issue4489_first_attempt.diff](https://bugs.python.org/file12484/issue4489_first_attempt.diff \"Uploaded as text/plain at 2008-12-29.08:30:39 by mrts\")\u003c/li\u003e\u003cli\u003e[test_issue4489.sh](https://bugs.python.org/file12485/test_issue4489.sh \"Uploaded as application/x-sh at 2008-12-29.11:15:02 by mrts\")\u003c/li\u003e\u003cli\u003e[i4489.patch](https://bugs.python.org/file20274/i4489.patch \"Uploaded as text/plain at 2011-01-05.14:27:03 by rosslagerwall\"): Initial patch and test\u003c/li\u003e\u003cli\u003e[i4489_v2.patch](https://bugs.python.org/file20277/i4489_v2.patch \"Uploaded as text/plain at 2011-01-05.16:58:16 by rosslagerwall\"): Updated patch\u003c/li\u003e\u003cli\u003e[i4489_v3.patch](https://bugs.python.org/file20279/i4489_v3.patch \"Uploaded as text/plain at 2011-01-05.18:19:22 by rosslagerwall\"): Updated patch\u003c/li\u003e\u003cli\u003e[i4489_v4.patch](https://bugs.python.org/file23261/i4489_v4.patch \"Uploaded as text/plain at 2011-09-29.19:42:55 by rosslagerwall\")\u003c/li\u003e\u003cli\u003e[rmtree-with-fwalk-v1.diff](https://bugs.python.org/file25630/rmtree-with-fwalk-v1.diff \"Uploaded as text/plain at 2012-05-18.11:30:38 by @hynek\")\u003c/li\u003e\u003cli\u003e[rmtree-with-fwalk-docs-v1.diff](https://bugs.python.org/file25631/rmtree-with-fwalk-docs-v1.diff \"Uploaded as text/plain at 2012-05-18.12:51:11 by @hynek\")\u003c/li\u003e\u003cli\u003e[rmtree-with-fwalk-v2.diff](https://bugs.python.org/file25649/rmtree-with-fwalk-v2.diff \"Uploaded as text/plain at 2012-05-20.14:05:46 by @hynek\")\u003c/li\u003e\u003cli\u003e[rmtree-with-fwalk-v3.diff](https://bugs.python.org/file25660/rmtree-with-fwalk-v3.diff \"Uploaded as text/plain at 2012-05-21.07:47:37 by @hynek\")\u003c/li\u003e\u003cli\u003e[direct_rmtree_safe.diff](https://bugs.python.org/file25935/direct_rmtree_safe.diff \"Uploaded as text/plain at 2012-06-10.20:40:03 by @loewis\")\u003c/li\u003e\u003cli\u003e[mvl-revisited-plus-docs.diff](https://bugs.python.org/file26089/mvl-revisited-plus-docs.diff \"Uploaded as text/plain at 2012-06-22.17:28:49 by @hynek\")\u003c/li\u003e\n\n\u003csup\u003e*Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.*\u003c/sup\u003e\n\n\u003cdetails\u003e\u003csummary\u003eShow more details\u003c/summary\u003e\u003cp\u003e\n\nGitHub fields:\n```python\nassignee = 'https://github.com/hynek'\nclosed_at = \u003cDate 2012-06-28.10:39:44.997\u003e\ncreated_at = \u003cDate 2008-12-02.15:42:01.840\u003e\nlabels = ['type-security', 'library', 'release-blocker']\ntitle = 'shutil.rmtree is vulnerable to a symlink attack'\nupdated_at = \u003cDate 2020-10-25.13:33:48.102\u003e\nuser = 'https://bugs.python.org/mrts'\n```\n\nbugs.python.org fields:\n```python\nactivity = \u003cDate 2020-10-25.13:33:48.102\u003e\nactor = 'blueyed'\nassignee = 'hynek'\nclosed = True\nclosed_date = \u003cDate 2012-06-28.10:39:44.997\u003e\ncloser = 'hynek'\ncomponents = ['Library (Lib)']\ncreation = \u003cDate 2008-12-02.15:42:01.840\u003e\ncreator = 'mrts'\ndependencies = ['4761', '10755', '13734', '14773']\nfiles = ['12482', '12484', '12485', '20274', '20277', '20279', '23261', '25630', '25631', '25649', '25660', '25935', '26089']\nhgrepos = []\nissue_num = 4489\nkeywords = ['patch', 'needs review']\nmessage_count = 83.0\nmessages = ['76753', '78389', '78391', '78398', '78405', '78406', '78418', '78425', '78440', '78441', '78442', '78443', '78444', '78445', '78446', '78447', '78448', '78451', '103686', '124472', '125425', '125429', '125435', '125436', '125446', '142609', '144621', '145113', '145133', '147058', '147059', '147080', '147217', '147249', '150794', '150810', '150834', '150952', '159467', '159622', '161047', '161048', '161050', '161130', '161207', '161250', '161256', '161266', '162558', '162559', '162596', '162609', '163089', '163092', '163338', '163444', '163636', '163655', '163721', '163722', '163723', '163726', '163729', '163731', '163732', '163733', '163734', '163735', '163736', '163738', '163874', '163877', '163883', '163884', '163941', '164197', '164234', '164235', '164245', '164247', '164248', '164251', '164255']\nnosy_count = 19.0\nnosy_names = ['loewis', 'georg.brandl', 'jcea', 'ncoghlan', 'pitrou', 'larry', 'blueyed', 'schmir', 'tarek', 'ezio.melotti', 'eric.araujo', 'Arfrever', 'mrts', 'neologix', 'teamnoir', 'rosslagerwall', 'python-dev', 'petri.lehtinen', 'hynek']\npr_nums = ['22968']\npriority = 'release blocker'\nresolution = 'fixed'\nstage = 'resolved'\nstatus = 'closed'\nsuperseder = None\ntype = 'security'\nurl = 'https://bugs.python.org/issue4489'\nversions = ['Python 3.3']\n```\n\n\u003c/p\u003e\u003c/details\u003e\n","author":{"url":"https://github.com/mrts","@type":"Person","name":"mrts"},"datePublished":"2008-12-02T15:42:02.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":83},"url":"https://github.com/48739/cpython/issues/48739"}