TOCTTOU in File::Path::rmtree() Version 2.12 (continued 1)

• lstat is a system call made to store information for later use

  • Hence, qualifies as a "Time of Check"

        if ( -d _ ) {

• lstat and stat set the special _ filehandle

  • Use as operand to file test operator to avoid expense of another system call

  • Boils down to: "If we have a directory, ..."

            if ( !chdir($root) ) {

• Recursive removal requires ability to chdir down as far deep as needed

• This is an instance of "Time of Use"