|
 |
43b6d6 |
From f0ada4fd4d9f4a6c028f86306e62fe880949d4e1 Mon Sep 17 00:00:00 2001
|
|
|
43b6d6 |
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
|
|
|
43b6d6 |
Date: Wed, 27 Nov 2013 10:58:07 +0100
|
|
|
43b6d6 |
Subject: [PATCH] Do not use already existing temporary files
|
|
|
43b6d6 |
MIME-Version: 1.0
|
|
|
43b6d6 |
Content-Type: text/plain; charset=UTF-8
|
|
|
43b6d6 |
Content-Transfer-Encoding: 8bit
|
|
|
43b6d6 |
|
|
|
43b6d6 |
mirror() method tries to create a new temporary file as can be
|
|
|
43b6d6 |
concluded by using random name.
|
|
|
43b6d6 |
|
|
|
43b6d6 |
To prevent from from attacks, one has to make sure the file does not
|
|
|
43b6d6 |
exist. This patch creates temporary files with O_CREAT|O_EXCL mode.
|
|
|
43b6d6 |
|
|
|
43b6d6 |
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
|
|
43b6d6 |
---
|
|
|
43b6d6 |
lib/HTTP/Tiny.pm | 5 +++--
|
|
|
43b6d6 |
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
43b6d6 |
|
|
|
43b6d6 |
diff --git a/lib/HTTP/Tiny.pm b/lib/HTTP/Tiny.pm
|
|
|
43b6d6 |
index 8736816..6ee800e 100644
|
|
|
43b6d6 |
--- a/lib/HTTP/Tiny.pm
|
|
|
43b6d6 |
+++ b/lib/HTTP/Tiny.pm
|
|
|
43b6d6 |
@@ -6,6 +6,7 @@ use warnings;
|
|
|
43b6d6 |
our $VERSION = '0.033'; # VERSION
|
|
|
43b6d6 |
|
|
|
43b6d6 |
use Carp ();
|
|
|
43b6d6 |
+use Fcntl ();
|
|
|
43b6d6 |
|
|
|
43b6d6 |
|
|
|
43b6d6 |
my @attributes;
|
|
|
43b6d6 |
@@ -113,8 +114,8 @@ sub mirror {
|
|
|
43b6d6 |
$args->{headers}{'if-modified-since'} ||= $self->_http_date($mtime);
|
|
|
43b6d6 |
}
|
|
|
43b6d6 |
my $tempfile = $file . int(rand(2**31));
|
|
|
43b6d6 |
- open my $fh, ">", $tempfile
|
|
|
43b6d6 |
- or Carp::croak(qq/Error: Could not open temporary file $tempfile for downloading: $!\n/);
|
|
|
43b6d6 |
+ sysopen my $fh, $tempfile, Fcntl::O_CREAT|Fcntl::O_EXCL|Fcntl::O_WRONLY
|
|
|
43b6d6 |
+ or Carp::croak(qq/Error: Could not create temporary file $tempfile for downloading: $!\n/);
|
|
|
43b6d6 |
binmode $fh;
|
|
|
43b6d6 |
$args->{data_callback} = sub {
|
|
|
43b6d6 |
print {$fh} $_[0]
|
|
|
43b6d6 |
--
|
|
|
43b6d6 |
1.8.3.1
|
|
|
43b6d6 |
|