Skip to content

fix: skip chmod on existing directories in SaveUploadedFile#4631

Open
Herrtian wants to merge 1 commit intogin-gonic:masterfrom
Herrtian:fix/save-uploaded-file-chmod
Open

fix: skip chmod on existing directories in SaveUploadedFile#4631
Herrtian wants to merge 1 commit intogin-gonic:masterfrom
Herrtian:fix/save-uploaded-file-chmod

Conversation

@Herrtian
Copy link
Copy Markdown

Summary

Fixes #4622

SaveUploadedFile called os.Chmod on the target directory unconditionally, even if it already existed. This broke file uploads to system directories like /tmp:

chmod /tmp: operation not permitted

Change

Added a check before calling os.Chmod: only newly created directories get their permissions set. Pre-existing directories are left untouched.

// Before: always chmod (breaks on /tmp, /var, etc.)
os.MkdirAll(dir, mode)
os.Chmod(dir, mode)  // fails if dir is /tmp

// After: only chmod new directories
dirExisted := dirExists(dir)
os.MkdirAll(dir, mode)
if !dirExisted {
    os.Chmod(dir, mode)
}

Updated TestSaveUploadedFileWithPermission to verify permissions on a newly created subdirectory rather than the current working directory. Added a Windows skip for the permission assertion since Windows doesn't support Unix file permissions.

Test plan

  • go build ./... passes
  • TestSaveUploadedFileWithPermission passes
  • TestSaveUploadedFileWithPermissionFailed passes
  • TestFileDescriptor failure is pre-existing (fails on master too on Windows)

SaveUploadedFile called os.Chmod on the target directory even if it
already existed. This breaks when saving to system directories like
/tmp where the process lacks permission to chmod.

Now only newly created directories get chmod'd. Existing directories
are left as-is, which is the correct behavior since the caller should
not modify permissions of directories they don't own.

Fixes gin-gonic#4622
@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 15, 2026

Codecov Report

❌ Patch coverage is 71.42857% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 98.37%. Comparing base (3dc1cd6) to head (6cfac86).
⚠️ Report is 275 commits behind head on master.

Files with missing lines Patch % Lines
context.go 71.42% 1 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4631      +/-   ##
==========================================
- Coverage   99.21%   98.37%   -0.84%     
==========================================
  Files          42       48       +6     
  Lines        3182     3143      -39     
==========================================
- Hits         3157     3092      -65     
- Misses         17       42      +25     
- Partials        8        9       +1     
Flag Coverage Δ
?
--ldflags="-checklinkname=0" -tags sonic 98.36% <71.42%> (?)
-tags go_json 98.30% <71.42%> (?)
-tags nomsgpack 98.35% <71.42%> (?)
go-1.18 ?
go-1.19 ?
go-1.20 ?
go-1.21 ?
go-1.25 98.37% <71.42%> (?)
go-1.26 98.37% <71.42%> (?)
macos-latest 98.37% <71.42%> (-0.84%) ⬇️
ubuntu-latest 98.37% <71.42%> (-0.84%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SaveUploadedFile: unexpected chmod on existing directories (breaks /tmp usage)

1 participant