107088 - mozilla creates world-readable temp files

Status: VERIFIED FIXED

(Core Graveyard :: File Handling, defect)

Description

[Alex Yurchenko]

when mozilla downloads a file to launch a plugin on it
(e.g. mp3 player) it sotres the file in /tmp directory
which by default is open to the world, moreover, the file
has world readable permissions. If mozilla crashes,
those files stay there forever, it wouldn't delete them
on restart.

1) shouldn't those files be stored in a private directory?
maybe a subdir in /tmp, but closed to the world, so that
on restart those files could be located easily and deleted.

2) shouldn't those files ultimately be handled through the
common cache mechanism, like regular images and html docs?
Why can't they be just ordinary items in cache?

Comment 1

[Matthias Versen [:Matti]]

*** This bug has been marked as a duplicate of 55690 ***

Comment 2

[timeless]

vrfy dupe

Comment 3

[timeless]

for now, the TMPDIR env var should override /tmp, do what you like w/ it. if 
you want, we can even relnote it.

Comment 4

[Boris Zbarsky [:bzbarsky]]

http://lxr.mozilla.org/seamonkey/source/uriloader/exthandler/nsExternalHelperApp
Service.cpp#921

 mTempFile->CreateUnique(nsIFile::NORMAL_FILE_TYPE, 0644);

http://lxr.mozilla.org/seamonkey/source/uriloader/exthandler/nsExternalHelperApp
Service.cpp#929

 rv = fts->CreateTransport(mTempFile, PR_WRONLY | PR_CREATE_FILE, 0664, 
getter_AddRefs(fileTransport));

Change perms to 0600 in both cases and this problem should be solved.  Setting 
status to new...

Comment 5

[Bill Law]

Attachment: Patch with fix suggested by Boris

Boris, can you review that, then?

Not being a Unix hacker, I interpret that change to mean we grant no priveleges
to group/world?

Comment 6

[Bill Law]

Scott, can you sr= that, please?

Comment 7

[Boris Zbarsky [:bzbarsky]]

Bill, could you make the same change in line 1091 in the same file?  It
currently has:

rv = mFinalFileDestination->CreateUnique(nsIFile::NORMAL_FILE_TYPE, 0644);

This is the creation of the nsIFile we copy to before launching the helper... 
Change that to be 0600 instead of 0644.  With that change also, r=bzbarsky.

And yes, that change gives no rights to group/world

Comment 8

[Darin Fisher]

sr=darin with the additional change suggested by bz.

Comment 9

[Bill Law]

Attachment: Updated patch with additional occurrence changed.

OK, got that one, too.

Will go in ASAP.

Comment 10

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 66182 [details] [diff] [review]
Updated patch with additional occurrence changed.

marking reviews (r=bzbarsky, sr=darin)

Comment 11

[Bill Law]

fixed

Comment 12

[sairuh (rarely reading bugmail)]

vrfy'd fixed using 2002.02.04.17 comm bits on linux rh7.2. tested with both
downloading a file and opening a file with a helper app: in both cases the temp
file [located in /tmp] only had r/w privs for the user [600].

Comment 13

[Ben Bucksch (:BenB)]

The fix for this bug might have caused bug 124814.

Comment 14

[Boris Zbarsky [:bzbarsky]]

It did, and that's a dup