Changeset 164179 in webkit

Timestamp:

Feb 15, 2014 1:15:49 PM (10 years ago)

Author:

rakuco@webkit.org

Message:

[EFL][WK2] Stop calling mktemp(3).
​https://bugs.webkit.org/show_bug.cgi?id=128826

Reviewed by Gyuyoung Kim.

mktemp(3) is an insecure function and should be avoided at all costs.
Replace its usage with mkdtemp(3): instead of just getting a file name
that is supposed to be random and unused, we now create a directory
with a random name and then put whatever files we need there with fixed
names.

• UIProcess/API/efl/tests/test_ewk2_cookie_manager.cpp:

(TEST_F):

• UIProcess/API/efl/tests/test_ewk2_download_job.cpp:

(TEST_F):

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/API/efl/tests/test_ewk2_cookie_manager.cpp (modified) (5 diffs)
• UIProcess/API/efl/tests/test_ewk2_download_job.cpp (modified) (3 diffs)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2014-02-15  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
+
+        [EFL][WK2] Stop calling mktemp(3).
+        https://bugs.webkit.org/show_bug.cgi?id=128826
+
+        Reviewed by Gyuyoung Kim.
+
+        mktemp(3) is an insecure function and should be avoided at all costs.
+        Replace its usage with mkdtemp(3): instead of just getting a file name
+        that is supposed to be random and unused, we now create a directory
+        with a random name and then put whatever files we need there with fixed
+        names.
+
+        * UIProcess/API/efl/tests/test_ewk2_cookie_manager.cpp:
+        (TEST_F):
+        * UIProcess/API/efl/tests/test_ewk2_download_job.cpp:
+        (TEST_F):
+
 2014-02-15  Dan Bernstein  <mitz@apple.com>
 

trunk/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_cookie_manager.cpp

@@ -23 +23 @@
 #include "UnitTestUtils/EWK2UnitTestBase.h"
 #include "UnitTestUtils/EWK2UnitTestServer.h"
+#include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -200 +201 @@
 
     // Make sure we don't get notifications when loading setting an existing persistent storage
-    char textStorage1[] = "/tmp/txt-cookie.XXXXXX";
-    ASSERT_TRUE(mktemp(textStorage1));
-    char textStorage2[] = "/tmp/txt-cookie.XXXXXX";
-    ASSERT_TRUE(mktemp(textStorage2));
+    char storageDirectory[] = "/tmp/ewk2_cookie_manager-XXXXXX";
+    ASSERT_TRUE(mkdtemp(storageDirectory));
+    char textStorage1[64];
+    snprintf(textStorage1, sizeof(textStorage1), "%s/txt-cookie1", storageDirectory);
+    char textStorage2[64];
+    snprintf(textStorage2, sizeof(textStorage2), "%s/txt-cookie2", storageDirectory);
 
     ewk_cookie_manager_persistent_storage_set(cookieManager, textStorage1, EWK_COOKIE_PERSISTENT_STORAGE_TEXT);
@@ -222 +225 @@
     unlink(textStorage1);
     unlink(textStorage2);
+    rmdir(storageDirectory);
 }
 
@@ -266 +270 @@
 
     // Generate unique names for cookie storages.
-    char textStorage[] = "/tmp/txt-cookie.XXXXXX";
-    ASSERT_TRUE(mktemp(textStorage));
-    char sqliteStorage[] = "/tmp/sqlite-cookie.XXXXXX";
-    ASSERT_TRUE(mktemp(sqliteStorage));
+    char storageDirectory[] = "/tmp/ewk2_cookie_manager-XXXXXX";
+    ASSERT_TRUE(mkdtemp(storageDirectory));
+    char textStorage[64];
+    snprintf(textStorage, sizeof(textStorage), "%s/txt-cookie", storageDirectory);
+    char sqliteStorage[64];
+    snprintf(sqliteStorage, sizeof(sqliteStorage), "%s/sqlite-cookie", storageDirectory);
 
     Ewk_Cookie_Manager* cookieManager = ewk_context_cookie_manager_get(ewk_view_context_get(webView()));
@@ -306 +312 @@
     unlink(textStorage);
     unlink(sqliteStorage);
+    rmdir(storageDirectory);
 }

trunk/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_download_job.cpp

@@ -30 +30 @@
 #include <sys/stat.h>
 #include <sys/types.h>
+#include <stdio.h>
+#include <stdlib.h>
 #include <unistd.h>
 
@@ -153 +155 @@
     httpServer->run(serverCallback);
 
-    // Generate unique name for destination file.
-    char destinationPath[] = "/tmp/pdf-file.XXXXXX";
-    ASSERT_TRUE(mktemp(destinationPath));
+    CString fileUrl = httpServer->getURLForPath(testFilePath);
 
-    CString fileUrl = httpServer->getURLForPath(testFilePath);
+    char destinationDirectory[] = "/tmp/ewk2_download_job-XXXXXX";
+    ASSERT_TRUE(mkdtemp(destinationDirectory));
+    char destinationPath[64];
+    snprintf(destinationPath, sizeof(destinationPath), "%s/pdf-file", destinationDirectory);
 
     DownloadTestData userData = { fileUrl.data(), destinationPath };
@@ -173 +176 @@
     // Clean up
     unlink(destinationPath);
+    rmdir(destinationDirectory);
 }