[rt.cpan.org #36982] rmtree() makes symlink targets world-writable

Sat Jun 21 02:11:56 2008: Request 36982 was acted upon.
Transaction: Ticket created by ntyni@iki.fi
       Queue: File-Path
     Subject: rmtree() makes symlink targets world-writable
   Broken in: 2.04
    Severity: Critical
       Owner: Nobody
  Requestors: ntyni@iki.fi
      Status: new
 Ticket <URL: http://rt.cpan.org/Ticket/Display.html?id=36982 >


Hi,

as reported in <http://bugs.debian.org/487319>, when rmtree() encounters
a symlink, it will change the permissions of the link target to the
permissions of the link, usually 0777.

% touch foo
% ln -s foo bar
% ls -l foo bar
lrwxrwxrwx 1 niko niko 3 2008-06-21 09:06 bar -> foo
-rw-r--r-- 1 niko niko 0 2008-06-21 09:06 foo
% perl -e 'use File::Path rmtree; rmtree bar'
% ls -l foo bar                              
ls: cannot access bar: No such file or directory
-rwxrwxrwx 1 niko niko 0 2008-06-21 09:06 foo

This is with Perl 5.10.0, containing File-Path 2.04, but I have verified
it with the 2.06_04 CPAN version too.

There's a proposed patch by Ben Hutchings in the Debian report linked
above, please have a look.
-- 
Niko Tyni
ntyni@debian.org

• [rt.cpan.org #36982] rmtree() makes symlink targets world-writable by ntyni@iki.fi via RT