[Bug 1925381] [NEW] rsync conceals file deletions from reporting when --dry-run --remove-source-files are used together

[Bill Yikes]

Public bug reported:

Rsync has an astonishing and dangerous bug:

The dry run feature (-n / --dry-run) fails to report file deletions when
--remove-source-files is used. This is quite serious. People use --dry-
run to see if an outcome will work as expected before a live run. When
the simulated run shows *less* destruction than the live run, the
consequences can be serious because rsync may unexpectedly destroy the
only copy of a file.

Users rely on --dry-run. Although users probably expect --dry-run to
have limitations, we don't expect destructive operations to be under
reported. If it were reversed, such that the live run were less
destructive than the dry run, this wouldn't be as serious.

Reproducer:

$ mkdir -p /tmp/src /tmp/dest
$ printf '%s\n' 'yada yada' > /tmp/src/foo.txt
$ printf '%s\n' 'yada yada' > /tmp/src/bar.txt
$ cp /tmp/src/foo.txt /tmp/dest
$ ls /tmp/src/ /tmp/dest/
/tmp/dest/:
foo.txt

/tmp/src/:
bar.txt  foo.txt

$ rsync -na --info=remove1 --remove-source-files --existing src/* dest/
(no output)

$ rsync -a --info=remove1 --remove-source-files --existing src/* dest/
sender removed foo.txt

$ ls /tmp/src/ /tmp/dest/
/tmp/dest/:
foo.txt

/tmp/src/:
bar.txt

Note this bug is similar but differs in a few ways:
https://bugzilla.samba.org/show_bug.cgi?id=3844

I've marked this as a security vulnerability because it causes
unexpected data loss due to --dry-run creating a false expectation.

** Affects: rsync (Ubuntu)
     Importance: Undecided
         Status: New

** Information type changed from Private Security to Public

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rsync in Ubuntu.
https://bugs.launchpad.net/bugs/1925381

Title:
  rsync conceals file deletions from reporting when --dry-run --remove-
  source-files are used together

Status in rsync package in Ubuntu:
  New

Bug description:
  Rsync has an astonishing and dangerous bug:

  The dry run feature (-n / --dry-run) fails to report file deletions
  when --remove-source-files is used. This is quite serious. People use
  --dry-run to see if an outcome will work as expected before a live
  run. When the simulated run shows *less* destruction than the live
  run, the consequences can be serious because rsync may unexpectedly
  destroy the only copy of a file.

  Users rely on --dry-run. Although users probably expect --dry-run to
  have limitations, we don't expect destructive operations to be under
  reported. If it were reversed, such that the live run were less
  destructive than the dry run, this wouldn't be as serious.

  Reproducer:

  $ mkdir -p /tmp/src /tmp/dest
  $ printf '%s\n' 'yada yada' > /tmp/src/foo.txt
  $ printf '%s\n' 'yada yada' > /tmp/src/bar.txt
  $ cp /tmp/src/foo.txt /tmp/dest
  $ ls /tmp/src/ /tmp/dest/
  /tmp/dest/:
  foo.txt

  /tmp/src/:
  bar.txt  foo.txt

  $ rsync -na --info=remove1 --remove-source-files --existing src/* dest/
  (no output)

  $ rsync -a --info=remove1 --remove-source-files --existing src/* dest/
  sender removed foo.txt

  $ ls /tmp/src/ /tmp/dest/
  /tmp/dest/:
  foo.txt

  /tmp/src/:
  bar.txt

  Note this bug is similar but differs in a few ways:
  https://bugzilla.samba.org/show_bug.cgi?id=3844

  I've marked this as a security vulnerability because it causes
  unexpected data loss due to --dry-run creating a false expectation.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rsync/+bug/1925381/+subscriptions