use fs.lchown rather than fs.chown and thereby fix the symlinks problem

isaacs#3 while not causing the TOCTOU vulnerability isaacs#14
simevo · Jan 11, 2018 · 0307bb7 · 0307bb7
1 parent c6c4384
commit 0307bb7
Showing 1 changed file with 2 additions and 9 deletions.
diff --git a/chownr.js b/chownr.js
@@ -15,19 +15,12 @@ function chownr (p, uid, gid, cb) {
     , errState = null
     children.forEach(function (child) {
       var pathChild = path.resolve(p, child);
-      fs.lstat(pathChild, function(er, stats) {
-        if (er)
-          return cb(er)
-        if (!stats.isSymbolicLink())
-          chownr(pathChild, uid, gid, then)
-        else
-          then()
-        })
+      chownr(pathChild, uid, gid, then)
     })
     function then (er) {
       if (errState) return
       if (er) return cb(errState = er)
-      if (-- len === 0) return fs.chown(p, uid, gid, cb)
+      if (-- len === 0) return fs.lchown(p, uid, gid, cb)
     }
   })
 }