apr-bugs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject DO NOT REPLY [Bug 47630] NTFS directory junctions ("mounted folders") should be treated like n*x mount points (APR_DIR, not APR_LNK)
Date Wed, 05 Aug 2009 16:04:25 GMT
https://issues.apache.org/bugzilla/show_bug.cgi?id=47630



--- Comment #10 from Will Rowe <wrowe@apache.org> 2009-08-05 09:04:20 PDT ---
junction path/to/cgi-bin path/to/htdocs/revealscript

is just one example, I'm not going to repeat 20 years of security issues
surrounding symlinks for your benefit.

Junctions are alias/symlinks.  A junction cannot point at an unmounted volume.

E.g. although my checkouts to develop apr on httpd look like

  build/
        httpd-2.2/
        apr-1.3/
        apr-util-1.3/
        apr-iconv-1.3/

so that svn up httpd-* apr-* bring all sources up-to-date, 

  build/
        httpd-2.2/
                  srclib/
                         apr <junction to apr-1.3>
                         apr-util <junction to apr-util-1.3>
                         apr-iconv <junction to apr-iconv-1.3>

Please don't tell me that this facility doesn't expose the same issues as
symlinks raise.  That's why APR was designed to handle symlinks in this manner.

The symlink protection is in there to help determine when aliases exist.

> If you are using this method to play tricks with your directory structure, and
> then use a program that uses the APR and does not happen to omit APR_FINFO_LINK
> when getting info about a directory, then the trick does not work with that
> program.

Precisely.  This is exactly the same impact on unix of a symlinked directory.  
Ergo the portability behavior is 100% correct, and this discussion really 
is finished.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@apr.apache.org
For additional commands, e-mail: bugs-help@apr.apache.org


Mime
View raw message