September 11 2017 File::Path Security Back

Why Was "Traditional" rmtree() Given Superpowers? (continued)

        NOTE: If the third parameter is not TRUE, rmtree() is *unsecure*
        in the face of failure or interruption.  Files and directories which
        were not deleted may be left with permissions reset to allow world
        read and write access.  Note also that the occurrence of errors in
        rmtree can be determined *only* by trapping diagnostic messages
        using $SIG{__WARN__}; it is not apparent from the return value.
        Therefore, you must be extremely careful about using rmtree($foo,$bar,0)
        in situations where security is an issue.


Home Last TOC Copyright © 2017 James E Keenan Back Next