1. 24 Oct, 1998 2 commits
    • Guido van Rossum's avatar
      The TemporaryFile() function has a security leak -- because the · 309f1b7d
      Guido van Rossum authored
      filenames generated are easily predictable, it is possible to trick an
      unsuspecting program into overwriting another file by creating a
      symbolic link with the predicted name.  Fix this by using the
      low-level os.open() function with the O_EXCL flag and mode 0700.  On
      non-Unix platforms, presumably there are no symbolic links so the
      problem doesn't exist.  The explicit test for Unix (posix, actually)
      makes it possible to change the non-Unix logic to work without a
      try-except clause.
      
      The mktemp() file is as unsafe as ever.
      309f1b7d
    • Guido van Rossum's avatar
      4afaa294
  2. 22 Oct, 1998 15 commits
  3. 21 Oct, 1998 12 commits
  4. 20 Oct, 1998 5 commits
  5. 19 Oct, 1998 6 commits