`uninstall_deps.py` may be vulnerable to `shutil.rmtree.avoids_symlink_attacks` #38

New issue

Open

opened 2024-05-05 09:18:27 +02:00 by so-rose · 0 comments

so-rose commented

2024-05-05 09:18:27 +02:00

Owner

Deleting the dependency folder is clean and easy, but there are apparently attacks where symbolic links can be manipulated to delete other things on a user's systems.

Whether this is practical is unknown, but it's worth investigating that our use of shutil.rmtree is valid and proper.

NOTE: Python does have auditing events internally, which can be hooked into.

Deleting the dependency folder is clean and easy, but there are apparently attacks where symbolic links can be manipulated to delete other things on a user's systems. Whether this is practical is unknown, but it's worth investigating that our use of `shutil.rmtree` is valid and proper. _NOTE: Python does have auditing events internally, which can be hooked into._