temporary file creation

[y9toi7y02 sneakemail com]

Speaking about security, how about this code? (in nautilus 2.5.3)

libnautilus-private/nautilus-file-utilities.c, line 343

nautilus_unique_temporary_file_name (void) {
      	const char *prefix = "/tmp/nautilus-temp-file";
      	char *file_name;
       	static guint count = 1;

       	file_name = g_strdup_printf ("%sXXXXXX", prefix);

      	if (mktemp (file_name) != file_name) {
   		g_free (file_name);
      		file_name = g_strdup_printf ("%s-%d-%d",
prefix, count++, getpid ());
      	}

	return file_name;

}

This one in libnautilus-private/nautilus-metafile.c, line 1740 is secure.

		temp_path = g_strconcat (metafile_path, "XXXXXX", NULL);
              	failed = FALSE;

              	fd = mkstemp (temp_path);
               	if (fd == -1) {
             		failed = TRUE;
		}

This one in src/nautilus-profiler.c, line 287 'snatched defeat from the
jaws of victory':

  	dump_file_name = g_strdup ("/tmp/nautilus-profile-log-XXXXXX");

 	fd = mkstemp (dump_file_name);

      	if (fd != -1) {
      		close (fd);
      	} else {
  		g_free (dump_file_name);
      		dump_file_name = g_strdup_printf
("/tmp/nautilus-profile-log.%d", getpid ());
	}

and this one in gnome-vfs 2.5.3:

modules/vfolder/vfolder-info.c, line 350

      	tmpfile = g_strdup_printf ("%s.tmp-%d",
      				   info->filename,
       				   (int) (tv.tv_sec ^ tv.tv_usec));

while in libgnomevfs/gnome-vfs-private-utils.c there is a function
gnome_vfs_create_temp that does this securely.

Depending on the location of the file, this may not be that hazardous, but
still it is not on the safe side and it provides another source for
unsecure cut and paste code.

And then there's the scripts in modules/extfs. Here's to hoping these are
never used..

Martijn Vernooij