Repository navigation
Make SVN fingerprint opens race-safe #1124
Description
Related to #1113.
The SVN fingerprint path checks run before ordinary fopen/opendir calls. A concurrent path swap can therefore replace a previously validated regular file or directory with a symlink, reparse point, special file, or path outside the working-copy root before it is opened.
Use no-follow, handle-relative opens where supported, or validate the opened handle identity and containment before reading. Add a regression test that swaps the candidate between validation and open.
Activity
DeusData commentedon Jul 16, 2026
Tracked as a 0.9.2-rc path-safety blocker for #1113/#1127. A pre-open path check is not sufficient when the subsequent open can race with a symlink, reparse point, special-file, or containment swap. The regression should exercise the swap at a deterministic test seam and validate the opened handle, not repeat the same pathname check.
DeusData commentedon Oct 19, 2026
Thank you for separating the validation/open race from ordinary path checks. I have no new opened-handle containment verification or resolution to report for this SVN blocker.