Documentation suggests vulnerable tempfile usage

[antong]

Examples in the documentation for cobra/doc suggest insecure tempfile usage:

err := doc.GenMarkdownTree(cmd, "/tmp")

[github-actions]

This issue is being marked as stale due to a long period of inactivity

[antong]

This is a potential security issue. How can this be reopened?

[marckhouzam]

Hi @antong, could you clarify what is the security issue and if writing to a generic temporary directory would be better for the example?

[antong]

Classic symlink attack: Say the command is cobra759. An attacker places a symlink /tmp/cobra759.md -> /home/bob/thesis.tex. Bob runs the code in the example, and his thesis is overwritten by the generated documentation. Or if run by root, then any file on the system can be overwritten or created. Modern Linux systems don't anymore allow this for directories (mainly tmp) with the sticky bit set in order to prevent this kind of attack. Older Linux systems allow this, and I don't know about other than Linux. Anyway, in my opinion the documentation shouldn't encourage such use.

[marckhouzam]

Thanks @antong. Would you be able to post a PR to update the documentation to a safe example?