From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux 2.4.3-ac9 i686; en-US; 0.8.1) Gecko/20010412 BuildID: 2001041214 When a file is uploaded through a form, Mozilla creates a /tmp/formpost file (or formpost-xxx to avoid overwriting) . This file is created with the 666^~umask perms. On most distros, the standard umask is 022, therefore, /tmp/formpost* files are world readable. As they can hold private content, this is an insecure behavior. Reproducible: Always Steps to Reproduce: 1.Upload a file through a form 2.Read /tmp/formpost Actual Results: Any user can read the posted data. Expected Results: Permissions should be enforced to 600

This is technically a dup of bug 15320. But that bug has recently gotten futured, so the correct solution (not creating temp files) is not going to happen anytime soon. confirming this bug as a request to just change the file permissions. In that form, nominating for beta1 and mozilla0.9.1 as a major security hole.

reassigning, known issue, probably a dup

Unfutured the other bug. Marking this a dup. Time to clean this up... *** This bug has been marked as a duplicate of 15320 ***

ok, verifying

Reopening since this is a much more serious issue than bug 15320 and that bug is nowhere close to being fixed.

taking

this patch looks good, except it might be really nice to take this time to switch over to using nsIFile instead of nsFileSpec (since you are switching from nsIFileSpec to nsFileSpec... might as well do the right thing and switch to nsIFile).

I was trying to, actually, but I see no way to do the equivalent of MakeUnique() with nsIFile. I suppose I could roll my own.... would that be better than using nsFileSpec for this functionality?

-> bz, pointed him to nsIFile::CreateUnique... he's going to work on a new patch that uses nsIFile :)

CreateUnique is a bastard child that doesn't do what you'd expect it to... But if you treat it right, it _can_ do the right thing. :)

Alexandru, would you review?

Comment on attachment 59981 [details] [diff] [review] Patch using nsIFile sr=darin BTW it's valid to write NS_ADDREF(*aMultipartDataFile = tempDir)... NS_ADDREF actually corresponds to an inline function :)

Comment on attachment 59981 [details] [diff] [review] Patch using nsIFile r= alexsavulov OPTIONAL: could we use everywhere nsIFile and get rid of nsIFileSpec usage?

Yes, but that's a separate bug... :)

checked in

no more temp files on linux.. verifying