Re: temp file hole?

[Michael Albinus <michael.albinus@gmx.de>]

Stefan Monnier <monnier@iro.umontreal.ca> writes:

Hi Stefan,

> I'm afraid that the recent change to tramp-make-temp-file to use
> makw-temp-name instead of make-temp-file introduced a security hole (the
> very hole plugged by the introduction of make-temp-file in the first place).

I confess that my Changelog entry is a little bit sloppy. And you are
right, there could be a security hole.

The other reason why I have switched from make-temp-file to
make-temp-name is that make-temp-file creates a file without the
possibility to declare a file name extension. In Tramp, it is
sometimes useful to have the same file name extension in both the
temporary file and the original file the temporary file is used
for. By this, some actions like deciding major mode etc works
automatically.

A solution could be that tramp-make-temp-file takes over part of the
implementation of make-temp-file, i.e. applies make-temp-name, adds
the desired extension to this file name, and creates immediately the
temporary file via a loop like in make-temp-file.

A similar approach should be applied to tramp-make-tramp-temp-file,
which suffers from this security hole since ever.

I'll commit a patch tonight (or tomorrow, depends on my spare time).

> -- Stefan

Thanks, and best regards, Michael.