New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use mkstemp instead of tmpfile #505

Open
thommey opened this Issue Jan 11, 2018 · 1 comment

Comments

Projects
None yet
2 participants
@thommey
Member

thommey commented Jan 11, 2018

Using tmpfile() can potentially be insecure as per http://cwe.mitre.org/data/definitions/377.html, mkstemp with previously set umask(0600) would be appropriate. Code changes can be small with fdopen() on the resulting file descriptor, or we can adjust the copying functions.

@michaelortmann

This comment has been minimized.

Show comment
Hide comment
@michaelortmann

michaelortmann Aug 6, 2018

Contributor

modern operating system tmpfile() does more than wrap around mkstemp and do fdopen().
for example see https://github.com/freebsd/freebsd/blob/master/lib/libc/stdio/tmpfile.c
so i dont think the code change would be that small
mkstemp() is only better than tmpfile, when done right.

but ive got a more important question:

there is an eggdrop.conf setting for transfer module called copy-to-tmp
why is this setting also used in share module?
this is confusing.
its even more confusing when i look into the share module
the copy_to_tmp does not what i understand when i read eggdrop.conf description of that setting
it does not do any additional copy of files

Contributor

michaelortmann commented Aug 6, 2018

modern operating system tmpfile() does more than wrap around mkstemp and do fdopen().
for example see https://github.com/freebsd/freebsd/blob/master/lib/libc/stdio/tmpfile.c
so i dont think the code change would be that small
mkstemp() is only better than tmpfile, when done right.

but ive got a more important question:

there is an eggdrop.conf setting for transfer module called copy-to-tmp
why is this setting also used in share module?
this is confusing.
its even more confusing when i look into the share module
the copy_to_tmp does not what i understand when i read eggdrop.conf description of that setting
it does not do any additional copy of files

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment