Hardcoded tempfile names -> security vulnerabilities about bash-oo-framework

[niieani]

I am aware of the problem and that this is a less-than-perfect workaround. However, I have not found any better way of getting variables out of a subshell. Do you have any better ideas?

Concurrency issue would be fixable by adding a $PID in front of the name. We could also use a location relative to the library with strict permissions for writing only by the user running the script. Not sure it that would fix the vulnerability in full, though.

Thanks for participating!

[charles-dyfis-net]

mktemp -- creating destinations guaranteed to be unique and to which no other user can write -- is the canonical best practice. Set such a variable in the parent process, use it from the children. (Portability makes things a bit more complex; GNU mktemp and the BSD versions don't have completely identical usage -- but this is very much possible to work around)

[niieani]

That might work. Though the file would have to be created preemptively, otherwise we'd have the same problem with getting it's filename.

[charles-dyfis-net]

Yup. Using an exit trap would make eager creation less awful from a cleanup perspective.

[niieani]

Fixed in d555fe2.