Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Close a race condition with temporary files
The previous code allowed a race where an attacker could watch for creation of a rapid creation and deletion of a temporary directory, substitute their own directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made ues of the private_data_dir. This code fixes the issue by creating the directory securely using mkdtemp() and not deleting it afterwards.
- Loading branch information