PR #356 added insecure use of tmp files

[pawal]

This is a severe security issue.
See more here:
https://security.stackexchange.com/questions/34397/how-can-an-attacker-use-a-fake-temp-file-to-compromise-a-program

[mattias-p]

Discussion started here: #356 (review)

So the issue is the known filename under a world writable directory, correct? Piping the file from wget to apt-key instead of employing a temporary file would fix the issue. Did you have some other fix in mind?

[pawal]

Yes.

There are two writes to /tmp in PR #356:

1. wget http://repo.mysql.com/mysql-community-release-el7-5.noarch.rpm -O /tmp/mysql-community-release-el7-5.noarch.rpm
2. wget https://www.postgresql.org/media/keys/ACCC4CF8.asc -O /tmp/ACCC4CF8.asc

If you can do pipe, that is much better. You can also randomize file names, if pipe does not work.

[mattias-p]

Fixed by #359