/tmp/pip-build not secure

[guettli]

Well known temporary file names like /tmp/pip-build are insecure.

eviluser@host:~$ ln -s /home/otheruser/some-directory /tmp/pip-build

otheruser@host:~$ pip install ....

--> pip writes in /home/otheruser/some-directory. The user "otheruser" does not know it.

I tried it with pip 1.2.1 and content was written to /home/otheruser/some-directory.

[pnasrat]

Can you check develop branch of pip I believe pull #516 would have fixed this.

[guettli]

/tmp/pip-build is still used and can be abused by the way I posted above.

I tried it just some minutes ago with current git branch develop.

You can see it here, too:

strace -f pip install --user foo 2> tmp/strace-pip.log

[d1b]

@guettli I believe #734 fixes this issue.

[qwcode]

to be explicit, for anyone coming to this, the main reason for a consistent build directory name, is for the pip install --no-install/--no-download workflow which assumes a consistent directory to work off of between seperate executions of pip. pull #734 seems like a good approach in that it tries to be secure and use a consistent name.

[qwcode]

addressed in pull #780

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.