Skip to content

SECURITY: options.template allows arbitrary paths to be injected into tmp #156

@silkentrance

Description

@silkentrance

Operating System

  • Linux
  • Windows 7
  • Windows 10
  • MacOS
  • other: all

NodeJS Version

  • 0.x
  • 4.x
  • 6.x
  • 7.x
  • other: all

Tmp Version

all existing and current code base.

Expected Behavior

options.template can contain arbitrary absolute or relative paths.

Experienced Behavior

Depending on the effective user, tmp will be able to create or delete or replace arbitrary files in the file system.

Security Concern

This can be a major security concern, depending on how applications make use of tmp.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions