Re: [joe] Patch from Fedora Core user of joe

[<ja...@av...>]

Josip Rodin <jo...@sr...> wrote:

> On Wed, Jun 02, 2004 at 06:30:45PM -0400, ja...@av... wrote:
> > 
> > How about: "umask 022; /bin/rm ispell.tmp; cat >ispell.tmp; etc..."
>
> There's still a race condition between the rm and the cat. Using $$ in
> the file name would improve the odds, but it's still shoddy.
>
> I did a cursory check for mktemp, mkstemp, tempfile on a couple of Solaris 7
> system and found none of them. It's doubtful that there's a decent solution
> without depending on a "new" program, but then, do old systems generally
> have ispell installed? (Needless to mention, mine didn't.)

It's tempting to have JOE's "make install" install a "mktemp" (and "ispell").

Actually I seem to remember that I knew that this was a security hole even 9
years ago, but was so peeved that "ispell -" didn't work that I didn't fix
it out of sheer annoyance.  It's doubly annoying that "aspell" can't pipe
either.  Oh yeah: I was also annoyed that you couldn't check a single word
by passing it on the command line.  "aspell" at least can do this.  There is
"ispell -a", but then the user interface has to be in JOE (plus you have to
pass the words in LISP).

One cheesy solution is to have JOE always make a ~/.joe directory, and have
the script always put the temporary file there.  This has its own set of
problems- if two people are logged into the same account and are running the
editor at the same time, they can clash, plus what happens if you can't make
~/.joe?  But I have to deal with all of this anyway, because I want JOE to
save its state in a ~/.joe/joe.state file.