Re: [PATCH] Re: Insecure tempfile creation

[Daniel Shahaf <d.s@xxxxxxxxxxxxxxxxxx>]

Bart Schaefer wrote on Sun, Dec 28, 2014 at 00:41:01 -0800:
> On Dec 27, 11:44pm, Bart Schaefer wrote:
> }
> } I suppose =(<<<'') would actually be better, since it won't fork.  Hm.
> } 
> } This patch does not yet tackle uses of "/tmp" that do not use $TMPPREFIX
> 
> Fortunately I didn't find any of the latter except for the previously
> identified one in _cvs (_cvs_run).  So the patch below changes the use
> of =(:) to =(<<<'') and repairs _cvs_run to create the temp directory 
> in a safe (I hope) manner.  Apply on top of 34067.
> 

First of all, thanks for picking this up.  I'd meant to get back to this
thread early January, but I'm happy to have been beaten to it :-)

Your patches look good to me, including the rmdir, but except for:

> -	} =(: temporary file)
> +	} =(<<<'temporary file')

I assume =(<<<'') was the intention.

Thanks again,

Daniel