Skip to content

Draft: gtestutils: Don't follow symlinks when deleting tests' tempdir

Will Thompson requested to merge wjt/glib:dont-rm-rf-root into main

Previously, when cleaning up the temporary directory tree created by passing G_TEST_OPTION_ISOLATE_DIRS, any symbolic links in that tree would be followed recursively. If the test case has created a symbolic link in its temporary directory to a directory outside that tree, this could lead to unexpected data loss; in particular, if a developer has (unwisely) created a symbolic link to /, they could lose all data on the system.

On systems that have the ftw.h header, replace the current rm_rf() implementation with one that uses nftw() to perform a depth-first traversal without following symbolic links. Additionally, pass FTW_MOUNT to avoid crossing mount points, in case a test has mounted some other filesystem in the temporary directory.

nftw() is part of POSIX.1-2001, SUSv1, and glibc ≥ 2.1, so should be available on effectively every platform except Windows. (And Windows does not enable symbolic links by default so the developer error is less likely to occur there.)

The macOS ftw(3) manpage says:

These functions are provided for compatibility with legacy code. New code should use the fts(3) functions.

fts(3) does not seem to be part of any standard, but it does seem to be equally widely supported. The Linux manpages do not indicate that nftw() is deprecated.

Fixes: #3290

Merge request reports