When running 'freight-cache', a temporary working directory is created in $VARCACHE. And because $VARCACHE is also normally exposed via a webserver, the temporary files in this directory are also accessible from the outside. I'm not sure if this is a vulnerability, maybe it it not even an issue, but I find it not so elegant. In this pull request I added a config-option $TEMPDIR that can be set to use a different temporary directory instead.
Hello,
When running 'freight-cache', a temporary working directory is created in $VARCACHE. And because $VARCACHE is also normally exposed via a webserver, the temporary files in this directory are also accessible from the outside. I'm not sure if this is a vulnerability, maybe it it not even an issue, but I find it not so elegant. In this pull request I added a config-option $TEMPDIR that can be set to use a different temporary directory instead.
Maybe it helps someone.
Emiel Bruijntjes