nose-devs/nose — Issue #39: Usage of mkstemp in prof.py insecure
Author: jpellerin
Created: 2011-12-14 15:56:26+00:00
State: open

The usage of the tempfile.mkstemp function in the profile plugin is insecure.

The prof.py plugin gets the fileno and filename from the mkstemp function
and then closes the file descriptor, just to open the file by name later on.

This is insecure and has the same race condition issues as the older
tempfile.mktemp function, as it does not guarantee an atomic operation.

The safe way to use this would be to use the file object without
intermediate close, otherwise its no more secure than a plain
tempfile.mktemp().

Google Code Info:
Issue #: 31
Author: m...@contact.de
Created On: 2007-02-08T10:09:26.000Z
Closed On: 2007-04-18T23:55:49.000Z