On Sun, Jun 15, 2014 at 04:32:27PM +0000, brian m. carlson wrote:
> On Sun, Jun 15, 2014 at 08:51:23AM +0100, Pat Thoyts wrote:
> > David Aguilar <dav...@gmail.com> writes:
> > >--- a/gitk
> > >+++ b/gitk
> > >@@ -3502,7 +3502,8 @@ proc gitknewtmpdir {} {
> > >   } else {
> > >       set tmpdir $gitdir
> > >   }
> > >-  set gitktmpdir [file join $tmpdir [format ".gitk-tmp.%s" [pid]]]
> > >+  set gitktmpformat [file join $tmpdir ".gitk-tmp.XXXXXX"]
> > >+  set gitktmpdir [exec mktemp -d $gitktmpformat]
> > >   if {[catch {file mkdir $gitktmpdir} err]} {
> > >       error_popup "[mc "Error creating temporary directory %s:" 
> > > $gitktmpdir] $err"
> > >       unset gitktmpdir
> > 
> > This is a problem on Windows where we will not have mktemp. In Tcl 8.6
> > the file command acquired a "file tempfile" command to help with this
> > kind of issue (https://www.tcl.tk/man/tcl8.6/TclCmd/file.htm#M39) but
> > for older versions we should probably stick with the existing pattern at
> > least on Windows.
> 
> The existing pattern is a security bug on Unix systems. MITRE (CWE-377)
> tells me that it is a vulnerability on Windows as well, so you'd
> probably want to come up with a better solution than the existing
> pattern.
> 
> You also probably want to request a CVE for this, which the Red Hat and
> Debian security teams can do for you if you like.  Distributions will
> likely want to issue security advisories for this.

I don't think this requires a CVE since it's basically plugging a hole
that my previous patch introduced by making gitk honor the TMPDIR
variable; it hasn't strictly been in any release yet.

Does Git on Windows use a modern tcl?
I checked, and my (old) existing msysgit installation had tcl
8.5, so I unfortunately using "file tempname" won't help there.

Hmm.. I guess what I could do is keep the old behavior (having gitk ignore 
TMPDIR)
on Windows and only use the new code path on non-Windows.

That seems like it'd be the simplest implementation (no need to check versions)
and the least harmful to existing users (avoids a tcl upgrade or mkdtemp 
installation
for Windows users).
-- 
David
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to