search

DataTables / DataTablesSrc

DataTables source repository
https://datatables.net
MIT License
630 stars 422 forks source link

Build process uses static filenames in /tmp, does not catch errors #91

Open satta opened 7 years ago

satta commented 7 years ago

The build process (include.sh and friends) uses static filenames in/tmp/, among them /tmp/closure_error.log which in addition does not get removed after the build.

This may lead to issues on shared systems: although symlink attacks on build systems are not a very likely scenario, this still becomes a problem if the files already exist but belong to another user - something that happens if several users on the same host try to build that code. Please also note that the build system does not catch or address that situation.

Please see the corresponding Debian bug [1] which also includes a patch to serve as inspiration for a solution.

Thanks, Sascha

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850879

DataTables commented 7 years ago

Thank you - that's a very good point. Also doing twin builds on the same system causes the same issue.