Re: [Gnash-dev] unsafe use of /tmp

[Rob Savoye]

Patrice Dumas wrote:

> It seems that gnash downloads the .swf files in /tmp. This is unsafe and 
> opens the door for a symlink in /tmp attack. Moreover it allows other user
> to monitor a user activity. I believe the .swf should be downloaded in 
> ~/.gnash or similar. Or if downloaded to /tmp it should be done safely
> using mkstemp or similar things.

  This is only temporary. I plan to make Gnash read the stream and 
render it instead. Unfortunately right now Gnash only uses disk based 
files. I wasn't using mkstemp() because I wanted the download movie name 
to match what I see in the browser.

  Currently there isn't a ~/.gnash directory, but I'm considering 
adding one to hold a config file. I can switch to downloading to that 
directory as well.

        - rob -