Re: difflog.pl and "security"

[Wayne Davison <wayned@xxxxxxxxxxxxxxxxxxxxx>]

On Mon, Dec 03, 2007 at 10:42:56AM +0000, Peter Stephenson wrote:
> Maybe we should simply leave it out of the distribution (but leave it in
> the archive), since it's essentially no use unless you have a CVS tree.

Seems quite reasonable to me.  I also coded up an improved version that
uses File::Temp.  I also changed the opening of the DIFF pipe to use a
newer, safer exec syntax (since we don't need this to be very portable,
I figure the perl version should be recent enough for anyone who might
be using the script).

..wayne..

--- difflog.pl	18 Apr 2002 14:35:17 -0000	1.3
+++ difflog.pl	3 Dec 2007 21:32:03 -0000
@@ -2,10 +2,9 @@
 
 use strict;
 use IO::File;
+use File::Temp qw(tempfile);
 
 my @differ = qw(diff -bw);
-my $oldtmp = "/tmp/difflog$$.old";
-my $newtmp = "/tmp/difflog$$.new";
 
 my $newfn = pop(@ARGV);
 my $oldfn = pop(@ARGV);
@@ -36,16 +35,17 @@ while ($old < @oldentries && $new < @new
   else
   {
     if ($oldhash{$oldentries[$old]} ne $newhash{$newentries[$new]}) {
-      my $oldfh = new IO::File("/tmp/difflog$$.old", 'w');
-      $oldfh->print($oldhash{$oldentries[$old]});
-      $oldfh->close();
-      my $newfh = new IO::File("/tmp/difflog$$.new", 'w');
-      $newfh->print($newhash{$newentries[$new]});
-      $newfh->close();
-      open(DIFF, join(' ', @differ, @ARGV, $oldtmp, $newtmp, '|'));
+      my($oldfh, $oldtmp) = tempfile('difflog-XXXXXXXX', SUFFIX => '.old', DIR => '/tmp');
+      print $oldfh $oldhash{$oldentries[$old]};
+      close $oldfh;
+      my($newfh, $newtmp) = tempfile('difflog-XXXXXXXX', SUFFIX => '.new', DIR => '/tmp');
+      print $newfh $newhash{$newentries[$new]};
+      close $newfh;
+      open(DIFF, '-|', @differ, @ARGV, $oldtmp, $newtmp) or die $!;
       my @lines = <DIFF>;
       close(DIFF);
-      unlink </tmp/difflog$$.*>;
+      unlink($oldtmp);
+      unlink($newtmp);
       if (@lines)
       {
 	print "diff for ", $oldentries[$old], ":\n";