From: Caleb Clausen <vikkous@...>
Date: 2010-03-04T04:35:21+09:00
Subject: Re: A gem for handling temporary file(s)?

On 3/2/10, Albert Schlef <albertschlef@gmail.com> wrote:
> Paul Harrington wrote:
>> ri Tempfile
>>
>> that'll get you started
>
> Thanks! I didn't know about Tempfile.
>
> Though I have a little problem: Tempfile let me *open* a new temporary
> file. But I just need to generate a temporary file *name*, which I'll
> pass to a shell command.

I'm not expert enough to be certain about this, but by doing this
you'll be creating a tempfile race condition security hole in your
program. I think the same goes for Robert's suggestion as well. There
may be a way to do it securely... but it's probably tricky. One
advantage of Tempfile (and similar facilities in other languages) is
that it avoids this subtle and nassty security hole. But you have to
use it the way it wants to be used, otherwise you defeat the security.
This is why you're better off rewriting this external command in ruby,
if that's possible. Or rewriting your ruby script to make it an
integral part of the external program.

None of this may actually matter in your case... but you're the only
one with enough information to make that judgment.