Allowed values of temporary-path

[stefanct]

Prelude

I came here through #396 but reporting this on its own because it is not just a duplicate report.
Nevertheless, I strongly believe that the general resource exhaustion/configuration issue needs a more user-friendly message (at least if you want less people reporting bogus bugs).

Description

One can set . as temporary-path globally and that works fine. However I would like to have IM create a directory (e.g., .im-tmp) in the CWD but that does not seem to work correctly OR produce an error message if set - it simply output the temp files into CWD directly. I have searched the documentation and elsewhere but I am not able to identify any clear documentation on what's allowed in the temporary-path specifications and how it is supposed to work (e.g., if the directory has to exist).

Steps to Reproduce

1. Set

   <policy domain="resource" name="temporary-path" value=".im-tmp"/> 
   

   in the global policy file, e.g. /etc/ImageMagick-6/policy.xml.

2. Call a IM application that produces temp files and is slow enough.

3. Observe the files being created in the CWD instead of a newly created directory named .im-tmp.

System Configuration

• ImageMagick version: 6.9.7.4 (8:6.9.7.4+dfsg-11+deb9u6)
• Environment (Operating system, version and so on): Debian stretch (current stable)
• Additional information:

[urban-warrior]

The temporary path must be a preexisting writable directory. We'll document that requirement in the security policy page @ https://imagemagick.org/script/security-policy.php

[stefanct]

Yes, that's where I would have expected it, thank you! Even nicer would of course be if it would be created (and cleaned up again) if it doesnt exist yet ;)

[urban-warrior]

There are security implications when creating temporary paths and cleaning up can be even more problematic. Our preference is that the user handle the construction and destruction of temporary paths.