Re: ztempfile fixes (bug #686922)

On Fri, Aug 15, 2003 at 02:17:17PM +0400, Igor V. Melichev wrote:
> > From: "Raph Levien" <[email protected]>
> > To: <[email protected]>
> > Sent: Friday, August 15, 2003 3:50 AM
> > Subject: [gs-code-review] ztempfile fixes (bug #686922)
> 
> I agree that the current code is buggy in the point of permission check,
> and must be fixed. But I have 3 major objections against this patch :
> 
> 1.  It sets an artificial constraint for ztempfile argument,
> which doesn't come from the regular programming practice,
> and reduces the functionality. For example, it doesn't allow
> to open a scratch file in cwd.

Actually, it is regular programming practice to restrict
security-critical strings to a minimal set of characters; among other
things, it helps avoid platform-dependence. For example, if we allowed
':', code that works on Unix and Windows may fail on Macs.

> 2. It still has a security hole : it allows to place scratch files
> everywhere by specifying their location in the environment variable,
> without checking the location for permissions. 
> Rather this case can be considered as a user's error, 
> it is not obvious and is poorly documented.

The environment variable is not under PostScript control. Therefore,
I disagree that it is a security vulnerability.

> 3. The implementation of prefix_is_simple is not international.
> For example, a Russian user may need to use Cyrillic for file names,
> which appear prohibited by the patch.

I believe that the limitation to ASCII names is reasonable for the
purpose of tempfile prefixes. Operating systems may differ in their
ability to handle non-ASCII filenames, which would introduce a
platform dependence similar to the ':' mentioned above.

In addition, we'd have to depend on the fact that non-ASCII characters
are not interpreted as metacharacters, which would raise another
vulnerability.

Raph