SECURITY: options.template allows arbitrary paths to be injected into tmp

[silkentrance]

Operating System

• Linux
• Windows 7
• Windows 10
• MacOS
• other: all

NodeJS Version

• 0.x
• 4.x
• 6.x
• 7.x
• other: all

Tmp Version

all existing and current code base.

Expected Behavior

options.template can contain arbitrary absolute or relative paths.

Experienced Behavior

Depending on the effective user, tmp will be able to create or delete or replace arbitrary files in the file system.

Security Concern

This can be a major security concern, depending on how applications make use of tmp.

[silkentrance]

This requires #143.

[silkentrance]

With #143 in place this should no longer be a problem unless one is capable of injecting paths relative to the configure default or user provided tmp dir.

[silkentrance]

Still a problem. Reopening.