Merge pull request #548 from wiredfool/mktemp

Fix for insecure use of tempfile.mktemp
This commit is contained in:
Alex Clark ☺ 2014-03-14 19:12:49 -04:00
commit b4aca4dbeb
4 changed files with 20 additions and 11 deletions

View File

@ -67,8 +67,10 @@ def Ghostscript(tile, size, fp, scale=1):
import tempfile, os, subprocess
outfile = tempfile.mktemp()
infile = tempfile.mktemp()
out_fd, outfile = tempfile.mkstemp()
os.close(out_fd)
in_fd, infile = tempfile.mkstemp()
os.close(in_fd)
with open(infile, 'wb') as f:
fp.seek(offset)

View File

@ -504,14 +504,17 @@ class Image:
self.readonly = 0
def _dump(self, file=None, format=None):
import tempfile
import tempfile, os
if not file:
file = tempfile.mktemp()
f, file = tempfile.mkstemp(format or '')
os.close(f)
self.load()
if not format or format == "PPM":
self.im.save_ppm(file)
else:
file = file + "." + format
if file.endswith(format):
file = file + "." + format
self.save(file, format)
return file

View File

@ -172,8 +172,8 @@ class IptcImageFile(ImageFile.ImageFile):
self.fp.seek(offset)
# Copy image data to temporary file
outfile = tempfile.mktemp()
o = open(outfile, "wb")
o_fd, outfile = tempfile.mkstemp(text=False)
o = os.fdopen(o_fd)
if encoding == "raw":
# To simplify access to the extracted file,
# prepend a PPM header

View File

@ -344,13 +344,17 @@ class JpegImageFile(ImageFile.ImageFile):
# ALTERNATIVE: handle JPEGs via the IJG command line utilities
import tempfile, os
file = tempfile.mktemp()
os.system("djpeg %s >%s" % (self.filename, file))
f, path = tempfile.mkstemp()
os.close(f)
if os.path.exists(self.filename):
os.system("djpeg '%s' >'%s'" % (self.filename, path))
else:
raise ValueError("Invalid Filename")
try:
self.im = Image.core.open_ppm(file)
self.im = Image.core.open_ppm(path)
finally:
try: os.unlink(file)
try: os.unlink(path)
except: pass
self.mode = self.im.mode