Safely create temporary files and directories

[eelstork]

With reference to #3324 I propose a modified implementation of MakeTempDir.
@futurely and @netheril96 suggested that the designated issue may be caused by a race condition.

Upon closer inspection, I find that:

• Boost unique_path is specified to return a randomly generated path, which may or may not be unique. Boost implementations typically system level entropy sources to generate the path.
• Typical mkdtemp implementations rely on mkdir to generate temporary directories. Race conditions are avoided by checking the return value of mkdir instead of checking whether a generated path already exists.
• Paths generated using Boost use 4 bits of randomness per character. By comparison typical mkdtemp implementations may use 5 or 6 bits of randomness.

With this in mind the proposed solution is similar to how Python implements mkdtemp (tempfile.py, line 322).

[ronghanghu]

Thanks @eelstork ! This looks good

[eelstork]

Adding a commit targeting safe creation of temporary files. In this case the approach used to create temporary directories cannot be reused:

• mkstemp and open are not cross platform.
• fopen provides an x flag similar to O_EXCL however this requires C11.
• I do not know of an equivalent using standard C++ or Boost.

The proposed solution consists in (safely) creating a temporary directory. This temporary directory is then used as a container for all temporary files.
A similar approach is described in Apple's secure coding guide (thanks to @futurely for suggesting this reference).
In our case temp files are labeled using a counter, eliminating the need to test for homonyms.

Optionally, this approach may be extended to the creation of temporary directories (meaning: safely create a temp directory, then use it as a container for all temp files and directories).

[eelstork]

@ronghanghu this needs a little more work on my end, not compiling in VS.

[ronghanghu]

@eelstork Thank you and don't worry. I'll take a look when it's ready :)

[eelstork]

@ronghanghu ready for review.

[ronghanghu]

@eelstork Thanks! I'll try to take a look tomorrow

[ronghanghu]

Better to move this two static variables into function MakeTempFilename (while keeping them static) so that they are only accessible in that function.

[ronghanghu]

@eelstork This should be ready. Let's fix the minor issue mentioned above and I'll merge.

[eelstork]

Updated; looks good to me.

On 28 Nov 2015, at 10:21, Ronghang Hu notifications@github.com wrote:

@eelstork This should be ready. Let's fix the minor issue mentioned above and I'll merge.

—
Reply to this email directly or view it on GitHub.

[ronghanghu]

Thanks @eelstork !