[Date Prev][Date Next][Thread Prev][Thread Next]
[Date Index]
[Thread Index]
- Subject: Re: os.tmpname security risk?
- From: Steve Litt <slitt@...>
- Date: Wed, 13 Jul 2011 20:17:01 -0400
On Saturday, July 02, 2011 06:29:52 AM HyperHacker wrote:
> The 5.1 manual states, for os.tmpname():
> > On some systems (POSIX), this function also creates a file with
> > that name, to avoid security risks. (Someone else might create
> > the file with wrong permissions in the time between getting the
> > name and creating the file.)
>
> But what stops someone from removing that file and creating their
> own, or changing its permissions? It doesn't seem like this really
> mitigates the risk at all.
I think the assumption is you'll use the file very quickly and then
erase it, making it very hard for someone to switch out the file during
the short time you'll be using it.
I rolled my own temp file maker that in my opinion is better than those
offered by Lua's distribution:
http://www.troubleshooters.com/codecorn/lua/luaos.htm#_Temporary_Files
Be careful -- I think the "%%%" in the error message should be "@@@".
Good luck.
SteveT
--
Steve Litt
Recession Relief Package
http://www.recession-relief.US
Twitter: http://www.twitter.com/stevelitt