Closed Bug 94469 Opened 25 years ago Closed 24 years ago

/tmp/formpost follows symlinks

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED INVALID
Milestone:
mozilla1.1alpha

People

(Reporter: robbe, Assigned: alexsavulov)

References

Details

$ cd /tmp $ ls -l formpost* /home/robbe/oops ls: /home/robbe/oops: No such file or directory lrwxrwxrwx 1 robbe robbe 16 Aug 9 11:52 formpost -> /home/robbe/oops [... here I upload a file into a form ...] $ ls -l /home/robbe/oops -rw-rw-r-- 1 robbe robbe 825 Aug 9 12:08 /home/robbe/oops Bad! You can make a user overwrite his/her own files. The filename is easily guessable. If bug 15320 is fixed so that formpost are no longer dropped into /tmp, this one will no longer be an issue.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Over to eric
Assignee: rods → evaughan
Does this Workaround work for you? It uses an area you control instead of /tmp. 1. mkdir $HOME/.tmp 2. chmod 01700 $HOME/.tmp 3. (umask 077 ; env TMPDIR=$HOME/.tmp mozilla ) However, one of the problems is that the file name is guessable. Moz 0.9.4 seems to use O_EXCL now.
Reassigning to Alex
Assignee: evaughan → alexsavulov
darin: Can you take a look please? (i did set the target milestone, however it may be wrong)
Target Milestone: --- → mozilla1.1
The temp file may go away entirely soon. See bug 114106.
Depends on: 114106
temp files are gone... This is invalid now
Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → INVALID
verifying
Status: RESOLVED → VERIFIED
Component: HTML: Form Submission → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.