#30807: test_extract_file_permissions test fails when umask is set to 000.
-------------------------------------+-------------------------------------
Reporter: Brady | Owner: Ad
| Timmering
Type: Bug | Status: assigned
Component: Testing framework | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Ad Timmering):
* needs_better_patch: 1 => 0
* has_patch: 1 => 0
Comment:
TL;DR: I am wondering if we should undo fixes for #26494 (and therefore
also #27628) for security reasons rather than fix the test in this issue.
Any thoughts/input welcome.
**Short recap**
`Archive.extract` is only being used by django-admin commands
`startproject` and `startapp` to enable provisioning of custom archive
templates.
Originally we extracted using OS default permissions (set by umask).
In #26494 it was raised that scripts (eg. manage.py) extracted from an
archive were no longer executable.
In these cases the compressed scripts *did* have the executable flag set
in the archive.
This was addressed by applying permissions stored in archive metadata to
the extracted files.
In #27628 it was noted that subsequently in some cases file were being
extracted with zero permissions, causing errors as Django would not be
able to read for example template files.
In these cases the files in question have *no* permissions set in the
archive, and all default permissions were removed as result of fix #26494.
This was addressed by trying to ensure that files at the very least are
“readable”.
In #30807 as result of the above fix, we see that some archive tests are
failing on some platforms because the tests added in the most recent bug
did not properly account for a default umask not being 002.
**Suggested solution**
However, instead of addressing this issue, I would like to posit that we
maybe should not have applied the fix for #26494:
Users will frequently refer to archives downloaded from external sites
through a URL. In the current setup we rely on the archive to be trusted
and set executable permissions based on archive metadata.
- Do we not expose users unnecessarily to potential risk with unknown code
being set to executable?
- Should we not leave setting of “execute” permissions up to the user?
(Users responsibility to see if it is indeed the script/code they
intended)
--
Ticket URL: <https://code.djangoproject.com/ticket/30807#comment:7>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/065.d9f425f6aab4a6d64cb703355065c4b0%40djangoproject.com.
