From mboxrd@z Thu Jan 1 00:00:00 1970 From: Glenn Morris Subject: bug#17416: insecure temp files in ob-screen.el Date: Tue, 06 May 2014 00:14:36 -0400 Message-ID: <61ljbl1v.fsf__30929.9694876701$1399413894$gmane$org@fencepost.gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:45301) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WhWmV-0001LT-L3 for emacs-orgmode@gnu.org; Tue, 06 May 2014 00:15:04 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WhWmU-0003pe-Nh for emacs-orgmode@gnu.org; Tue, 06 May 2014 00:15:03 -0400 Sender: "Debbugs-submit" Resent-Message-ID: List-Id: "General discussions about Org-mode." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-orgmode-bounces+geo-emacs-orgmode=m.gmane.org@gnu.org Sender: emacs-orgmode-bounces+geo-emacs-orgmode=m.gmane.org@gnu.org To: 17416@debbugs.gnu.org Package: emacs,org-mode Version: 24.3.90 Severity: important Tags: security org-babel-screen-session-write-temp-file and org-babel-screen-test seem to use predictable temp-file names, which is a security issue. Using `make-temp-file', or if the file names really need to be predictable, something equivalent to `doc-view-make-safe-dir' (there should really be a general utility function for this IMO) to first create a /tmp subdirectory would avoid this.