mitsuhiko/jinja2 — pull request #292 by kilink (2014-01-18 17:36:56+00:00)
Title: Fix for CVE-2014-0012 (Insecure temp folder creation)

I think this one slipped through the cracks somehow, but the fix for [CVE-2014-1402](https://github.com/mitsuhiko/jinja2/commit/acb672b6a179567632e032f547582f30fa2f4aa7) introduced another security issue, which was assigned CVE-2014-0012.

This PR simply delegates temporary directory creation to `tempfile.mkdtemp()` in FileSystemBytecodeCache, which does the right thing.

The tests pass, but the only question I have is in regard to the intended behavior of the FilesystemBytecodeCache. Should multiple instances of a FileSystemBytecodeCache initialized without the directory argument point to the same directory? If so, I would need to modify my PR to stash the directory as a class variable (or something) to work around the issue.

Please see the following links for discussion of the issue:

http://seclists.org/oss-sec/2014/q1/73

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734956

Note that it looks like this was fixed via a similar patch in Debian, but it would be nice to have this upstream.