Skip to content
This repository was archived by the owner on Aug 2, 2022. It is now read-only.
This repository was archived by the owner on Aug 2, 2022. It is now read-only.

eosio.cdt writes to predictable and conflicting file in /tmp #742

@godmar

Description

@godmar

While debugging #741, I noticed that your eosio-cpp driver uses a temporary file in /tmp that's created ad-hoc by concatenating "/tmp" and the file name, e.g. /tmp/addressbook_with_age_and_notify.cpp.o when compiling addressbook_with_age_and_notify.cpp in a directory.

See here for the code that does this.

The above would make sense only in a single-user, single-process environment, otherwise it opens up the potential for conflicts or even TOCTOU attacks.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions