Josip Rodin <joy@...> wrote:
> On Wed, Jun 02, 2004 at 06:30:45PM -0400, jallen@... wrote:
> >
> > How about: "umask 022; /bin/rm ispell.tmp; cat >ispell.tmp; etc..."
>
> There's still a race condition between the rm and the cat. Using $$ in
> the file name would improve the odds, but it's still shoddy.
>
> I did a cursory check for mktemp, mkstemp, tempfile on a couple of Solaris 7
> system and found none of them. It's doubtful that there's a decent solution
> without depending on a "new" program, but then, do old systems generally
> have ispell installed? (Needless to mention, mine didn't.)
It's tempting to have JOE's "make install" install a "mktemp" (and "ispell").
Actually I seem to remember that I knew that this was a security hole even 9
years ago, but was so peeved that "ispell -" didn't work that I didn't fix
it out of sheer annoyance. It's doubly annoying that "aspell" can't pipe
either. Oh yeah: I was also annoyed that you couldn't check a single word
by passing it on the command line. "aspell" at least can do this. There is
"ispell -a", but then the user interface has to be in JOE (plus you have to
pass the words in LISP).
One cheesy solution is to have JOE always make a ~/.joe directory, and have
the script always put the temporary file there. This has its own set of
problems- if two people are logged into the same account and are running the
editor at the same time, they can clash, plus what happens if you can't make
~/.joe? But I have to deal with all of this anyway, because I want JOE to
save its state in a ~/.joe/joe.state file.
|