Fix 1 — Sticky bit check bypass (lines 48-58 and 128-132)

[nicolasva]

reference : rails/rails#56997

FIX 1

⏺ Summary

Context

The PR #67 on ruby/tmpdir received feedback from maintainer @rhenium requesting to split it into two separate PRs:

• Fix 1 — Sticky bit check bypass (configurable via environment variable)
• Fix 2 — Writability fallback (using stat.writable? when File.writable? fails)

What was done

Extracted Fix 1 only into the local branch fix_first_tmpdir:

lib/tmpdir.rb:

• Added allow_world_writable? private method that checks the RUBY_TMPDIR_ALLOW_WORLD_WRITABLE environment variable (accepts 1, true, or yes)
• Modified Dir.tmpdir to accept world-writable directories without sticky bit when the env var is set
• Modified Dir.mktmpdir to bypass the security check when the env var is set

test/test_tmpdir.rb:

• Added test_world_writable_allowed_by_env test case covering:
  • Default behavior (rejection without env var)
  • Acceptance with env var set to valid values (1, true, yes, TRUE, Yes)
  • Rejection with invalid values (0, false, no, 2, enabled)
  • mktmpdir working correctly with the env var

Test results

All 11 tests pass with 60 assertions (100% passed).