Re: [v2 PATCH] mktokens relative TMPDIR

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

On Wed, Apr 29, 2020 at 10:51:41AM -0700, Michael Greenberg wrote:
> The mktokens script fails when /tmp isn't writable (e.g., when building
> in a sandbox with a different TMPDIR). Replace absolute references to
> /tmp to relative references to TMPDIR. If TMPDIR is unset or null,
> default to /tmp.
> 
> The mkbuiltins script was already hardened to work relative to TMPDIR,
> also defaulting to /tmp.
> 
> v2 ensures that TMPDIR is quoted.
> 
> Signed-off-by: Michael Greenberg <michael.greenberg@xxxxxxxxxx>
> 
> diff --git a/src/mktokens b/src/mktokens
> index cd52241..3ab7bc5 100644
> --- a/src/mktokens
> +++ b/src/mktokens
> @@ -37,7 +37,9 @@
>  # token marks the end of a list.  The third column is the name to print in
>  # error messages.
> 
> -cat > /tmp/ka$$ <<\!
> +: ${TMPDIR:=/tmp}

Could you quote this one too? Otherwise it could result in
unnecessary pattern expansion (e.g., someone does TMPDIR=/*/*/*).

Thanks,
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt