Menu

#136 `xmlstarlet ed --inplace ...` silently fails to update files it doesn't have permission to edit

all
open
nobody
None
5
2026-03-16
2026-03-16
No

This is pretty simple to reproduce, just create a xml file you don't have permission to write to:

$ echo '<key value="value1" />' > ~/tmp/foo.xml
$ sudo chown root:root ~/tmp/foo.xml
$ xmlstarlet ed --inplace --update "/key/@value" --value "newval" ~/tmp/foo.xml
$ echo $?
0

Note how xmlstarlet appears to succeed (exits 0), but it did not update the file. You can see this with strace:

[jeremy@pattern:~/src/github.com/jfly/snow]$ strace , xmlstarlet ed --inplace --update "/key/@value" --value "newval" ~/tmp/foo.xml
...
openat(AT_FDCWD, "/home/jeremy/tmp/foo.xml", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EACCES (Permission denied)
exit_group(0)                           = ?
+++ exited with 0 +++

The fix is simple, we're calling some libxml2 functions to save to a file, but not actually checking their return values. I've attached a patch.

1 Attachments

Discussion


Log in to post a comment.

MongoDB Logo MongoDB