Zsh Mailing List Archive
Messages sorted by:
Reverse Date,
Date,
Thread,
Author
Re: Potential security issue in the zsh tests
On Mon, 5 Dec 2016 15:07:25 +0100
Vincent Lefevre <vincent@xxxxxxxxxx> wrote:
> When building zsh, I notice that zsh writes results of the tests
> directly under /tmp, e.g.
It's easy to do better.
pws
diff --git a/Test/C02cond.ztst b/Test/C02cond.ztst
index 40e4dfb..27a2259 100644
--- a/Test/C02cond.ztst
+++ b/Test/C02cond.ztst
@@ -11,9 +11,9 @@
typeset -gi isnfs
[[ "$(find . -prune -fstype nfs 2>/dev/null)" == "." ]] && isnfs=1
if (( isnfs )) &&
- (cd -q ${TMPPREFIX:h} >/dev/null 2>&1 &&
+ (cd -q ${ZTST_tmp} >/dev/null 2>&1 &&
[[ "$(find . -prune -fstype nfs 2>/dev/null)" != "." ]]); then
- filetmpprefix=${TMPPREFIX}-$$-
+ filetmpprefix=${ZTST_tmp}/condtest-$$-
isnfs=0
else
filetmpprefix=
diff --git a/Test/ztst.zsh b/Test/ztst.zsh
index 8ae06b8..0235095 100755
--- a/Test/ztst.zsh
+++ b/Test/ztst.zsh
@@ -104,19 +104,23 @@ fpath=( $ZTST_srcdir/../Functions/*~*/CVS(/)
$ZTST_srcdir/../Completion/*/*~*/CVS(/) )
: ${TMPPREFIX:=/tmp/zsh}
+ZTST_tmp=${TMPPREFIX}.ztst.$$
+if ! rm -f $ZTST_tmp || ! mkdir -p $ZTST_tmp || ! chmod go-w $ZTST_tmp; then
+ print "Can't create $ZTST_tmp for exclusive use." >&2
+ exit 1
+fi
# Temporary files for redirection inside tests.
-ZTST_in=${TMPPREFIX}.ztst.in.$$
+ZTST_in=${ZTST_tmp}/ztst.in
# hold the expected output
-ZTST_out=${TMPPREFIX}.ztst.out.$$
-ZTST_err=${TMPPREFIX}.ztst.err.$$
+ZTST_out=${ZTST_tmp}/ztst.out
+ZTST_err=${ZTST_tmp}/ztst.err
# hold the actual output from the test
-ZTST_tout=${TMPPREFIX}.ztst.tout.$$
-ZTST_terr=${TMPPREFIX}.ztst.terr.$$
+ZTST_tout=${ZTST_tmp}/ztst.tout
+ZTST_terr=${ZTST_tmp}/ztst.terr
ZTST_cleanup() {
cd $ZTST_testdir
- rm -rf $ZTST_testdir/dummy.tmp $ZTST_testdir/*.tmp(N) \
- ${TMPPREFIX}.ztst*$$(N)
+ rm -rf $ZTST_testdir/dummy.tmp $ZTST_testdir/*.tmp(N) ${ZTST_tmp}
}
# This cleanup always gets performed, even if we abort. Later,
Messages sorted by:
Reverse Date,
Date,
Thread,
Author