From 4f9a8fb45c141b3719e1b727150c6e034bb068d5 Mon Sep 17 00:00:00 2001 From: jake87 Date: Tue, 26 Oct 2021 17:50:39 +1100 Subject: [PATCH] Rewrote temp function to be safer, using findUnusedName --- packages/lib/file_ops.js | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-) diff --git a/packages/lib/file_ops.js b/packages/lib/file_ops.js index cbb36c97..82cc9846 100644 --- a/packages/lib/file_ops.js +++ b/packages/lib/file_ops.js @@ -68,29 +68,19 @@ async function findUnusedName(directory, name, extension = "") { } } } -/** - * Returns a path to a temporary file. - * - * Warning: this function should not be relied upon to be accurate for - * security sensitive applications. The selection process is inherently - * racy and a file or folder may have been created in the folder by the time - * this function returns. - * - * @param {string} prefix - prefix for file - * @param {string} suffix - suffix for file - * @param {string} tmpdir - directory for file - */ + async function getTempFile(prefix, suffix, tmpdir) { prefix = (typeof prefix !== "undefined") ? prefix : "tmp."; suffix = (typeof suffix !== "undefined") ? suffix : ""; tmpdir = tmpdir ? tmpdir : os.tmpdir(); - return path.join(tmpdir, prefix + crypto.randomBytes(16).toString("hex") + suffix); - // IMO, 16 bytes of random hex should be fine, and hex is allowable in any filesystem, but if - // some other system is better, please inform + let fullname = path.join(prefix + crypto.randomBytes(16).toString("hex") + suffix); + let fullpath = path.join(tmpdir, findUnusedName(tmpdir, fullname)); + // If the path is not still zero, return the path, but otherwise return -1 to indicate failure } module.exports = { getNewestFile, findUnusedName, getTempFile, + checkIfFileExists, };