Bug #70690 for Finance-Quote: Finance::Quote::IndiaMutual temp file creation

Thu Sep 01 19:13:52 2011 vishal.grover [...] gmail.com - Ticket created

Subject:	Finance::Quote::IndiaMutual temp file creation
Date:	Fri, 2 Sep 2011 00:13:44 +0100
To:	bug-Finance-Quote [...] rt.cpan.org
From:	Vishal Grover <vishal.grover [...] gmail.com>

Hi, Finance::Quote::IndiaMutual uses a hardcoded temporary file for downloaded NAVs. This approach fails with ActivePerl on Windows. A simple patch is below 15a16 Show quoted text

> use File::Temp qw / tempfile /;

25c26 < $AMFI_NAV_LIST = "/tmp/amfinavlist.txt"; --- Show quoted text

> (undef, $AMFI_NAV_LIST) = tempfile();

Thanks Vishal

Mon Jan 16 11:34:25 2012 sbrabec [...] suse.cz - Correspondence added

From:

sbrabec [...] suse.cz

Fix as a unified patch.

Subject:

perl-Finance-Quote-70690-IndiaMutual-temp.patch

https://rt.cpan.org/Public/Bug/Display.html?id=70690 Subject: Finance::Quote::IndiaMutual temp file creation Date: Fri, 2 Sep 2011 00:13:44 +0100 To: bug-Finance-Quote [...] rt.cpan.org From: Vishal Grover <vishal.grover [...] gmail.com> Hi, Finance::Quote::IndiaMutual uses a hardcoded temporary file for downloaded NAVs. This approach fails with ActivePerl on Windows. A simple patch is below Thanks Vishal Index: finance-quote/lib/Finance/Quote/IndiaMutual.pm =================================================================== --- finance-quote.orig/lib/Finance/Quote/IndiaMutual.pm +++ finance-quote/lib/Finance/Quote/IndiaMutual.pm @@ -13,6 +13,7 @@ use LWP::UserAgent; use HTTP::Request::Common; use HTTP::Status; use HTML::TableExtract; +use File::Temp qw / tempfile /; $VERSION = '1.17'; @@ -22,7 +23,7 @@ $VERSION = '1.17'; $AMFI_MAIN_URL = ("http://amfiindia.com/"); $AMFI_URL = ("${AMFI_MAIN_URL}NavReport.aspx?type=0"); #$AMFI_URL = ("${AMFI_MAIN_URL}spages/NAV0.txt"); This page seems to do the job also. Keep for reference -$AMFI_NAV_LIST = "/tmp/amfinavlist.txt"; +(undef, $AMFI_NAV_LIST) = tempfile(); sub methods { return (indiamutual => \&amfiindia, amfiindia => \&amfiindia); }

Mon Jan 16 11:34:32 2012 The RT System itself - Status changed from 'new' to 'open'

Mon Jan 16 13:36:01 2012 sbrabec [...] suse.cz - Correspondence added

From:

sbrabec [...] suse.cz

Proposed fix is incomplete, as it leaves randomly named file in temp every time the module is called. I just verified, that the original buggy code is not exploitable via temp symlink on UNIX systems. But it has one ugly effect: One user that used India Mutual makes impossible to use India Mutual by any other user on the same system.

Tue Jan 17 12:31:49 2012 sbrabec [...] suse.cz - Correspondence added

From:

sbrabec [...] suse.cz

Delete temp file as soon as possible (incremental patch).

Subject:

perl-Finance-Quote-70690-IndiaMutual-temp-del.patch

Index: finance-quote/lib/Finance/Quote/IndiaMutual.pm =================================================================== --- finance-quote.orig/lib/Finance/Quote/IndiaMutual.pm +++ finance-quote/lib/Finance/Quote/IndiaMutual.pm @@ -67,6 +67,7 @@ sub amfiindia { open NAV, $AMFI_NAV_LIST or die "Unexpected error in opening file: $!\n"; + unlink ($AMFI_NAV_LIST); # Scheme Code;Scheme Name;Net Asset Value;Repurchase Price;Sale Price;Date while (<NAV>) {

Sat Sep 29 06:28:29 2012 eco [...] ecocode.net - Correspondence added 30 min

Hi! Thanks for checking this out. However, I think we should _not_ remove the usage of the cache file. The reason behind this is that we are talking about a 1meg data file which won't be re- fetched if the file did not change on the server. Therefor we need to keep the cache-file in a known place. However, I guess actual code doesn't work on Windows systems. We'd need a OS independent way to get to the temporary directory, keeping a well-defined file name. So I used the environment variable TMPDIR to locate the file. If this is correctly defined (with an ending slash or backslash), IndiaMutual should work on all platforms. -- Erik

Sat Sep 29 06:28:31 2012 eco [...] ecocode.net - Status changed from 'open' to 'resolved'

Sat Sep 29 06:28:31 2012 eco [...] ecocode.net - Given to ecocode