Potential security issue in the zsh tests

Potential security issue in the zsh tests

[Vincent Lefevre]

Hi,

When building zsh, I notice that zsh writes results of the tests
directly under /tmp, e.g.

-rw-r--r-- 1 vlefevre vlefevre  0 2016-12-05 15:05:36 /tmp/zsh.ztst.err.14513
-rw-r--r-- 1 vlefevre vlefevre  0 2016-12-05 15:05:36 /tmp/zsh.ztst.in.14513
-rw-r--r-- 1 vlefevre vlefevre 13 2016-12-05 15:05:36 /tmp/zsh.ztst.out.14513
-rw-r--r-- 1 vlefevre vlefevre  0 2016-12-05 15:05:36 /tmp/zsh.ztst.terr.14513
-rw-r--r-- 1 vlefevre vlefevre 13 2016-12-05 15:05:36 /tmp/zsh.ztst.tout.14513

I wonder whether it could be subject to symlink attacks.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Re: Potential security issue in the zsh tests

[Peter Stephenson]

On Mon, 5 Dec 2016 15:07:25 +0100
Vincent Lefevre <vincent@vinc17.net> wrote:
> When building zsh, I notice that zsh writes results of the tests
> directly under /tmp, e.g.

It's easy to do better.

pws

diff --git a/Test/C02cond.ztst b/Test/C02cond.ztst
index 40e4dfb..27a2259 100644
--- a/Test/C02cond.ztst
+++ b/Test/C02cond.ztst
@@ -11,9 +11,9 @@
   typeset -gi isnfs
   [[ "$(find . -prune -fstype nfs 2>/dev/null)" == "." ]] && isnfs=1
   if (( isnfs )) &&
-    (cd -q ${TMPPREFIX:h} >/dev/null 2>&1 &&
+    (cd -q ${ZTST_tmp} >/dev/null 2>&1 &&
      [[ "$(find . -prune -fstype nfs 2>/dev/null)" != "." ]]); then
-    filetmpprefix=${TMPPREFIX}-$$-
+    filetmpprefix=${ZTST_tmp}/condtest-$$-
     isnfs=0
   else
     filetmpprefix=
diff --git a/Test/ztst.zsh b/Test/ztst.zsh
index 8ae06b8..0235095 100755
--- a/Test/ztst.zsh
+++ b/Test/ztst.zsh
@@ -104,19 +104,23 @@ fpath=( $ZTST_srcdir/../Functions/*~*/CVS(/)
         $ZTST_srcdir/../Completion/*/*~*/CVS(/) )
 
 : ${TMPPREFIX:=/tmp/zsh}
+ZTST_tmp=${TMPPREFIX}.ztst.$$
+if ! rm -f $ZTST_tmp || ! mkdir -p $ZTST_tmp || ! chmod go-w $ZTST_tmp; then
+  print "Can't create $ZTST_tmp for exclusive use." >&2
+  exit 1
+fi
 # Temporary files for redirection inside tests.
-ZTST_in=${TMPPREFIX}.ztst.in.$$
+ZTST_in=${ZTST_tmp}/ztst.in
 # hold the expected output
-ZTST_out=${TMPPREFIX}.ztst.out.$$
-ZTST_err=${TMPPREFIX}.ztst.err.$$
+ZTST_out=${ZTST_tmp}/ztst.out
+ZTST_err=${ZTST_tmp}/ztst.err
 # hold the actual output from the test
-ZTST_tout=${TMPPREFIX}.ztst.tout.$$
-ZTST_terr=${TMPPREFIX}.ztst.terr.$$
+ZTST_tout=${ZTST_tmp}/ztst.tout
+ZTST_terr=${ZTST_tmp}/ztst.terr
 
 ZTST_cleanup() {
   cd $ZTST_testdir
-  rm -rf $ZTST_testdir/dummy.tmp $ZTST_testdir/*.tmp(N) \
-    ${TMPPREFIX}.ztst*$$(N)
+  rm -rf $ZTST_testdir/dummy.tmp $ZTST_testdir/*.tmp(N) ${ZTST_tmp}
 }
 
 # This cleanup always gets performed, even if we abort.  Later,