Re: [PATCH] Re: Insecure tempfile creation

[Peter Stephenson <p.stephenson@xxxxxxxxxxx>]

On Fri, 9 Jan 2015 03:51:01 +0100
Mikael Magnusson <mikachu@xxxxxxxxx> wrote:
> On Thu, Jan 8, 2015 at 3:24 PM, Peter Stephenson
> <p.stephenson@xxxxxxxxxxx> wrote:
> > It's a little bit tangential, but it's always bothered me that the only
> > option we have for module builtins of this kind is to import the into
> > the command namespace under the standard name, trashing the use of the
> > system-standard utility your code may elsewhere depend on That is, you
> > can use "command ln" if you need to, but the point is in the majority of
> > existing code you would never have bothered to do that.
> >
> > We made special arrangements for (z)stat but that really doesn't scale
> > well.
> >
> > Apart from (z)stat, most of the builtins that look like standard utilies
> > are only there for special cases, e.g. for some reason you can't get to
> > the file system where they live, in which case there's no real problem.
> > But for uses like this there potentially is.
> 
> Actually all the builtins foo in zsh/files are also available as zf_foo.

You're right, that's another, different, special case.  But it's the one
that probably matters the most in practice.

pws