New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
File::Temp should create tempdir subdirectory whenever possible #11959
Comments
From @epaCreated by @epaThe secure way to make temporary files is with File::Temp. Sometimes Since File::Temp already contains code to securely make a temporary Of course, whether this leads to a vulnerability in practice depends I am not going to claim this is a vulnerability in Perl itself or that Perl Info
|
From @ppisarOn 2012-02-14, Ed Avis <perlbug-followup@perl.org> wrote:
Actually this or similar issue is already tracked on CPAN -- Petr |
The RT System itself - Status changed from 'new' to 'open' |
From @epaPetr Pisar <ppisar <at> redhat.com> writes:
I believe that is a different issue. There, if you pass your own What I'm referring to is that if you just call tempfile() using the -- |
From @ppisarOn 2012-02-15, Ed Avis <eda@waniasset.com> wrote:
You are right.
Well, external tool can have a logic to traverse all parent directories I think this is problem of the external tool and its input. I heard -- Petr |
From @epaPetr Pisar <ppisar <at> redhat.com> writes:
In principle, yes. But I am considering how to make temporary file So while I agree that in a perfect world somebody would audit all It's the same consideration with the filename generated. Why does Temporary files are hard to get right even for experienced
I think it is a pretty common idiom to say my ($fh, $filename) = tempfile(); If it were just some weird one-off case I would not suggest any fix, -- |
From @ppisarOn 2012-02-16, Ed Avis <eda@waniasset.com> wrote:
I don't remember whole XSLT specification, but isn't this problem just I don't share your estimation on weird one-off and pretty common Thus instead of modifying tempfile(), I would add new function or new -- Petr |
Migrated from rt.perl.org#110730 (status was 'open')
Searchable as RT110730$
The text was updated successfully, but these errors were encountered: