Re: A gem for handling temporary file(s)?

2010/3/3 Caleb Clausen <[e-mail]>:
> On 3/3/10, Robert Klemme <[e-mail]> wrote:
>> On 03/03/2010 08:35 PM, Caleb Clausen wrote:
>>> I'm not expert enough to be certain about this, but by doing this
>>> you'll be creating a tempfile race condition security hole in your
>>> program. I think the same goes for Robert's suggestion as well.
>>
>> Do you mean there is a robustness issue or a security issue? =A0I don't
>> see a security issue here. =A0Robustness would only be at risk if the fi=
le
>> name generation algorithm is bad. =A0What else am I missing?
>
> It's a security issue. See:
> http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/avoid-race.=
html
> and scroll down to "7.10.1.2. Temporary Files"
>
> As I implied above, I may not know what I'm talking about here, but
> I'm fairly sure. Also, I didn't contemplate the snippet you
> contributed closely; perhaps it avoids the race condition in some
> clever way that I'm unaware of.

Thanks for the link.  If I understand all this right this cannot be
fixed as long as a) there are two processes involved or b) the second
process (dot) cannot be made inherit the file descriptor.  An
alternative approach would avoid a shared directory like /tmp and
write the output in $HOME/.../somewhere - which might be slower
because /tmp is often mounted in RAM.  Maybe it helps to create a
directory in /tmp which is owned by and only accessible to $USER; then
create the tempfiles in that directory.

>>> There
>>> may be a way to do it securely... but it's probably tricky. One
>>> advantage of Tempfile (and similar facilities in other languages) is
>>> that it avoids this subtle and nassty security hole. But you have to
>>> use it the way it wants to be used, otherwise you defeat the security.
>>> This is why you're better off rewriting this external command in ruby,
>>> if that's possible. Or rewriting your ruby script to make it an
>>> integral part of the external program.
>>>
>>> None of this may actually matter in your case... but you're the only
>>> one with enough information to make that judgment.
>>
>> Albert still did not disclose what the external program should do with
>> the temporary file. =A0We do not even know whether it is an option to
>> rewrite the external program.
>
> Yes, indeed. Which is why I said "if that's possible".

Yep.  I mainly included the remark to poke Albert so he would
eventually give the information. ;-)

Kind regards

robert

--=20
remember.guy do |as, often| as.you_can - without end
http://blog.rubybestpractices.com/