RetroSearch Browse

Sun Nov 9 21:11:57 EST 2003 · https://mail.python.org/pipermail/python-dev/2003-November/040140.html

> Hello,
> 
> The tempfile.mktemp function uses os.path.exists to test whether a file
> already exists. Since this returns false for broken symbolic links,
> wouldn't it be better if the function would actually do an os.lstat on
> the filename?
> 
> I know the function is not safe by definition, but this issue could
> (with a low probability) cause the file to actually be created in
> another directory, as the non-existent target of the symlink, instead of
> in the given directory (the one in which the symlink resides).
> 
> Regards,
> Iustin Pop

Sounds like a good suggestion; I'll see if I can check something in.

(However, given that there already exists an attack on this function,
does fixing this actually make any difference?)

--Guido van Rossum (home page: http://www.python.org/~guido/)

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://mail.python.org/pipermail/python-dev/2003-November/040140.html below:

[Python-Dev] tempfile.mktemp and os.path.exists