GHSA-FQF6-GXHH-2XHW: Root-Cause Fix for Backup Activation on --suffix

Vulnerability

GHSA-FQF6-GXHH-2XHW describes a behavioral mismatch in uutils coreutils where providing --suffix alone did not enable backup mode. As a result, commands such as cp, mv, ln, and install could overwrite or replace an existing destination without creating the expected backup artifact, causing silent data loss. The issue is rooted in backup-mode resolution: suffix selection was treated as a passive formatting parameter instead of a signal that backup behavior should be active.

The patch source in PR #9741 shows that the vulnerable path failed to derive a backup mode when only --suffix was present. This diverged from expected utility semantics where a custom suffix implies backup creation, with mode defaulting to existing unless overridden by VERSION_CONTROL.

} else if matches.contains_id(arguments::OPT_SUFFIX) {
        // Suffix option is enough to determine mode even if --backup is not set.
        // If VERSION_CONTROL is not set, the default backup type is 'existing'.
        if let Ok(method) = env::var("VERSION_CONTROL") {
            match_method(&method, "$VERSION_CONTROL")
        } else {
            Ok(BackupMode::Existing)
        }

Patch

The patch updates determine_backup_mode in src/uucore/src/lib/features/backup_control.rs so that presence of --suffix alone is sufficient to activate backup mode. If VERSION_CONTROL is set, its value is parsed and used; otherwise the code defaults to BackupMode::Existing. This is a direct correction to the decision logic rather than a downstream mitigation.

The change is reinforced with unit tests for backup-mode derivation and integration tests across affected utilities. Added tests verify that:

• cp creates destination + suffix when only --suffix is specified.
• mv preserves the overwritten destination as a backup under the custom suffix.
• ln creates a backup of the replaced link/target path under suffix-only invocation.
• install also honors suffix-only backup activation.
• Environment-driven mode selection via VERSION_CONTROL still applies when --suffix is used without --backup.

This broadens coverage beyond the core parser and materially reduces regression risk. The relevant implementation and tests are visible in the patch review.

Review

Pros

• The fix addresses the actual control-flow defect in backup-mode determination rather than adding command-specific workarounds.
• Behavior now matches the advisory's expected semantics: --suffix is treated as an implicit request for backup creation.
• The fallback to BackupMode::Existing is explicit and source-grounded, while still honoring VERSION_CONTROL when present.
• Test coverage spans both unit-level mode resolution and end-to-end utility behavior for cp, mv, ln, and install.
• The integration tests validate the security-relevant outcome: the original destination content survives in a backup file instead of being silently discarded.

Cons

• The patch summary does not show whether all utilities sharing backup logic are covered; review confidence is strongest for the explicitly tested commands.
• The diff excerpt focuses on positive-path behavior and does not demonstrate additional negative tests for malformed VERSION_CONTROL values in the suffix-only path.
• Because this is a semantics-alignment fix, downstream scripts that accidentally relied on the old non-backup behavior may observe changed filesystem side effects, though that change is desirable from a safety perspective.

Verdict

Root-cause.

This patch corrects the central state-resolution bug that caused suffix-only invocations to bypass backup activation. The implementation change is minimal but semantically complete: it moves backup enablement into the shared decision point and applies the documented defaulting behavior. The accompanying tests demonstrate that the fix propagates to affected file-manipulation commands and preserves overwritten data as intended. Based on the advisory at GitHub Security Advisory and the code changes in PR #9741, this is a solid root-cause remediation rather than a bandaid or partial fix.