| Subject: | insecure temporary files handling |
Hi,
And Thanks for Archive::Zip.
Please consider using File::Temp for temporary files creation,
since there are security risks. The attached patch proposes a fix
with which all tests pass.
--
Alexey Tourbin
ALT Linux Team
--- Archive-Zip-1.10~/Makefile.PL 2003-10-20 13:50:36 +0000
+++ Archive-Zip-1.10/Makefile.PL 2004-05-18 12:32:40 +0000
@@ -45,6 +45,7 @@ WriteMakefile(
'IO::Seekable' => 0,
# 'Test' => 0,
'Time::Local' => 0,
+ 'File::Temp' => 0,
},
EXE_FILES => [ qw( crc32 ) ],
clean => {
--- Archive-Zip-1.10~/lib/Archive/Zip.pm 2004-03-25 14:31:29 +0000
+++ Archive-Zip-1.10/lib/Archive/Zip.pm 2004-05-18 13:04:59 +0000
@@ -23,9 +23,11 @@ use IO::File();
use IO::Seekable();
use Compress::Zlib();
use File::Spec 0.8 ();
+use File::Temp ();
+use sigtrap qw(die normal-signals);
use vars
- qw( @ISA @EXPORT_OK %EXPORT_TAGS $VERSION $ChunkSize $ErrorHandler $TempSequence);
+ qw( @ISA @EXPORT_OK %EXPORT_TAGS $VERSION $ChunkSize $ErrorHandler);
# This is the size we'll try to read, write, and (de)compress.
# You could set it to something different if you had lots of memory
@@ -400,29 +402,12 @@ sub _readSignature # Archive::Zip
# my ($fh, $name) = Archive::Zip::tempFile();
# my ($fh, $name) = Archive::Zip::tempFile('mytempdir');
#
-BEGIN { $Archive::Zip::TempSequence = 0 }
-
-sub tempFileName # Archive::Zip
-{
- my $temp_dir = shift;
- $temp_dir = ( -d '/tmp' ? '/tmp' : $ENV{TMPDIR} || $ENV{TEMP} || '.' )
- unless defined($temp_dir);
- unless ( -d $temp_dir )
- {
- mkdir( $temp_dir, 0777 )
- or die "Can't create temp directory $temp_dir\: $!\n";
- }
- my $base_name =
- sprintf( "%d-%d.%d", $$, time(), $Archive::Zip::TempSequence++ );
- return File::Spec->canonpath(
- File::Spec->catpath( '', $temp_dir, $base_name ) );
-}
sub tempFile # Archive::Zip
{
- my $full_name = tempFileName(@_);
- my $fh = IO::File->new( $full_name, '+>' );
- return defined($fh) ? ( $fh, $full_name ) : ();
+ my $dir = shift;
+ return File::Temp::tempfile(SUFFIX => '.zip', UNLINK => 1,
+ $dir ? (DIR => $dir) : ());
}
# Return the normalized directory name as used in a zip file (path