[Patches] Patch to make tempfile return random filenames

Guido van Rossum guido@python.org
Sun, 21 May 2000 12:17:08 -0700


Hm, I don't like this very much.  Random sequences have a small but
nonzero probability of generating the same number in rapid succession
-- probably one in a million or so.  It would be very bad if one in a
million rums of a particular application crashed for this reason.

A better way do prevent this kind of attack (if you care about it) is
to use mktemp.TemporaryFile(), which avoids this vulnerability in a
different way.

(Also note the test for os.path.exists() so that an attacker would
have to use very precise timing to make this work.)

--Guido van Rossum (home page: http://www.python.org/~guido/)