Menu
▾
▴
#360 TIP#210: Add tempname subcommand to file
closed-fixed
5
2008-11-29
2004-07-28
No
This patch adds a new tempname subcommand to the file command.
The patch changes generic/tclCmdAH.c and generic/tclFCmd.c, adding a new command and function, which essentially calls the ANSI function tmpnam().
Changes to the file.n man page and test suite are included.
The Linux Programmer's Manual (Linux man pages) isn't very flattering towards tmpnam(). It basically says to use mkstemp() instead, but that function is POSIX instead of ANSI C.
Discussion
Need to update to use mkstemp() or something like that.
I think there is no need to go into C level. Have a look at tcllibs ::fileutil::tempfile for Tcl only implementation that's fine with regard to race conditions and security.
Please stay away from tmpnam() and friends. Consider:
* http://cwe.mitre.org/data/definitions/377.html
* https://buildsecurityin.us-cert.gov/daisy/bsi-rules/home/g1/861-BSI.html
mkstemp() is the only way to go at C-Level...
kind regards -- Matthias Kraft
Implemented.
At C level, we're using mkstemps() or mkstemp() on Unix, and something fairly horrible on Win (which still has the right security properties).