filesystem/build
Andrey Semashev 36cf9aaf81 Updated protection of remove_all against CVE-2022-21658 on POSIX.
The previous implementation could still allow for following symlinks
while remove_all is running if a directory was replaced with a symlink
higher in the tree than remove_all is currently processing. This was
reported here:

https://github.com/boostorg/filesystem/issues/224#issuecomment-1183738097

The solution is to use POSIX.1-2008 *at APIs to prevent symlink resolution
higher in the directory tree while iterating over the subtree in remove_all.
This required updating the directory iterator construction interface so that
it is possible to pass the base directory fd and return fd of the directory
used by the iterator. This is done via platform-specific params that are
currently defined only for POSIX. Additionally, status, symlink_status and
remove were extended to accept the base directory fd as well.

Other systems, including Windows, remain vulnerable.

Related to https://github.com/boostorg/filesystem/issues/224.
2022-07-17 04:00:07 +03:00
..
Jamfile.v2 Updated protection of remove_all against CVE-2022-21658 on POSIX. 2022-07-17 04:00:07 +03:00