Re: pinocchio tmp vuln

[Mikko Korpela <mikko.korpela () gmail com>]

This pinocchio sounds like a cool testing tool.

I have to say I don't understand at all why someone would be going
through random packages from PyPi (especially test automation related)
and searching for possible security issues.
Could someone explain why this kind of security issues (malicious user
making a symlink to some random file that is used during testing)
should be in the scope of test automation tools?


2014-09-09 9:26 GMT+03:00 David Jorm <djorm () redhat com>:
> On 09/09/2014 04:21 PM, Kurt Seifried wrote:
> > https://pypi.python.org/pypi/pinocchio/
> >
> > pinocchio       stopwatch       --with-stopwatch        Select tests based
> > on execution time
> >
> > pinocchio-0.4.1/pinocchio/stopwatch.py
> >
> >      def finalize(self, result):
> >          """
> >          Save the recorded times, OR dump them into /tmp if the file
> >          open fails.
> >          """
> >          try:
> >              fp = open(self.stopwatch_file, 'w')
> >          except (IOError, OSError):
> >              t = int(time.time())
> >              filename = '/tmp/nose-stopwatch-%s.pickle' % (t,)
> >
> > int(time.time) is easily guessed, create a few thousand and you're
> > covered for the next few hours and can stop anyone from using stopwatch,
> > or you can just blow away files as usual =).
> >
> >              fp = open(filename, 'w')
> >              log.warning('WARNING: stopwatch cannot write to "%s"' %
> > (self.stopwatch_file))
> >              log.warning('WARNING: stopwatch is using "%s" to save times'
> > % (filename,))
> >
> >          dump(self.times, fp)
> >          fp.close()
>
> You're a troll :)



-- 
Mikko Korpela