From: Caleb Clausen <vikkous@...>
Date: 2010-03-04T07:41:38+09:00
Subject: Re: A gem for handling temporary file(s)?

On 3/3/10, Robert Klemme <shortcutter@googlemail.com> wrote:
> On 03/03/2010 08:35 PM, Caleb Clausen wrote:
>> I'm not expert enough to be certain about this, but by doing this
>> you'll be creating a tempfile race condition security hole in your
>> program. I think the same goes for Robert's suggestion as well.
>
> Do you mean there is a robustness issue or a security issue?  I don't
> see a security issue here.  Robustness would only be at risk if the file
> name generation algorithm is bad.  What else am I missing?

It's a security issue. See:
http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/avoid-race.html
and scroll down to "7.10.1.2. Temporary Files"

As I implied above, I may not know what I'm talking about here, but
I'm fairly sure. Also, I didn't contemplate the snippet you
contributed closely; perhaps it avoids the race condition in some
clever way that I'm unaware of.

>> There
>> may be a way to do it securely... but it's probably tricky. One
>> advantage of Tempfile (and similar facilities in other languages) is
>> that it avoids this subtle and nassty security hole. But you have to
>> use it the way it wants to be used, otherwise you defeat the security.
>> This is why you're better off rewriting this external command in ruby,
>> if that's possible. Or rewriting your ruby script to make it an
>> integral part of the external program.
>>
>> None of this may actually matter in your case... but you're the only
>> one with enough information to make that judgment.
>
> Albert still did not disclose what the external program should do with
> the temporary file.  We do not even know whether it is an option to
> rewrite the external program.

Yes, indeed. Which is why I said "if that's possible".