-
Notifications
You must be signed in to change notification settings - Fork 252
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
The obj folder should be created with Directory.CreateDirectory #7908
Comments
nkolev92
changed the title
The obj folder should not be created with rwx rights, but the default ones.
The obj folder should not be created with 777 rights, but the default process one
Mar 25, 2019
nkolev92
changed the title
The obj folder should not be created with 777 rights, but the default process one
The obj folder should not be created with 777 permissions, but the default process one
Mar 25, 2019
nkolev92
changed the title
The obj folder should not be created with 777 permissions, but the default process one
The obj folder should be created with the default process rights
Mar 26, 2019
nkolev92
changed the title
The obj folder should be created with the default process rights
The obj folder should be created with Directory.CreateDirectory
Mar 26, 2019
Will close when it's merged to 5.0.1. |
Merged with NuGet/NuGet.Client@e32a2ea. |
This security fix shipped in NuGet 5.0.2 |
@rrelyea, @nkolev92: Is there any information in which version the issue reffered to by CVE-2019-0976 was introduced? |
@carnil |
@nkolev92: thanks for the confirmation |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Originally reported in #7341.
Specifically this is the issue that @bricelam & team reported.
The scenario is restore on mac/linux & it repros equivalently on 2.1, 2.2 and 3.0 preview runtimes.
NuGet writes to various directories during restore. NuGet uses the /tmp directory and as it’s a machine-wide directory NuGet has to create a directory that’s shareable across users as multiple users.
We have an implementation, that basically creates a folder as the same level as the wanted one and moves to the intended directory path.
NuGet restore is frequently the first tool to write to the obj folder during build. As such we need to create the obj folder. An oversight during an implementation of a new feature caused this CreateSharedDirectory method to be called for the obj folder. Now changing back to Directory.CreateDirectory fixes this particular problem, but understanding what exactly happened is important for our future investigation of issues in a similar codepath.
The scenario is the following. All the projects in a solution are redirected from root directory of the project obj to /obj/projectName/.
NuGet runs 8 concurrent project restore operations at the same time.
All 8 make a call to create the path/to/solution/root/obj/projectName.
Due to reasons I don’t understand Directory.CreateDirectory method throws with an error such as:
error : Could not find a part of the path '/home/nikolev/nuget.client/artifacts/39b567ca-81be-4b14-a271-a9be767a6888'. [/home/nikolev/nuget.client/src/NuGet.Core/NuGet.DependencyResolver.Core/NuGet.DependencyResolver.Core.csproj]
This only repros when there are at least 6-7 projects being restored. I was never able to repro it on with fewer projects.
I have added logs to the DirectoryUtility, and generated the logs.
https://github.com/NuGet/NuGet.Client/blob/1f9ad07fbbc5e80ab11eee4b4ea125d99dc6b291/src/NuGet.Core/NuGet.Common/PathUtil/DirectoryUtility.cs
The branch with the logs is dev-nkolev92-pathIssues
PathIssueLogs.txt
On the side I'll be working to truly understand the root cause.
I will raise a PR fixing this particular problem.
The text was updated successfully, but these errors were encountered: