Avoid leading .. for temporary files from Filesystem recursive remove #49581
Conversation
Are these tools right when they consider this path as risky? To my knowledge, there is no risk of accessing the parent directory here. But this change looks good anyway, someone seeing a path like |
Precisely as you say. The tools aren't right, strictly speaking, but usually when I find |
|
Thank you @giosh94mhz. |
Method
Filesystem::doRemoveis using renaming of parent directory before recursive removal, in order to implement atomic remove.This is a good thing, but to implement this is generating a random path name, with a modified base64 which replaces base64's
=sign with.. This may lead to directory named aspath/..8U6/which freaked out our synchronization tools and security log scanner.Since the leading
.is already (correctly) hard-coded, I see no issue in using_as a safer alternative.