Author: wade
Date: 2006-10-05 14:10:24 -0400 (Thu, 05 Oct 2006)
New Revision: 66300
Modified:
branches/mono-1-1-4/mcs/class/System/System.CodeDom.Compiler/ChangeLog
branches/mono-1-1-4/mcs/class/System/System.CodeDom.Compiler/TempFileCollection.cs
Log:
* TempFileCollection.cs: Bring in changes from HEAD for serialization
security fix:
* r51229: Added a call to GC.SuppressFinalize in Dispose.
* r52181: Changed BasePath property to use Path.
GetTempPath (Environment check) and added the PathDiscovery check on
the combined result. Fixed TempDir so it's value never change (i.e.
imply that it doesn't need any permissions). Fixed SyncRoot to always
return null.
* r57836: Implement explicitly some interface methods to get rid of
the "!" errors on CorCompare.
* r60253: Make sure generated file names are unique. Fixes bug #76125
and #78230.
* r65441: Create files in a temporary subdirectory, for security reasons.
Modified: branches/mono-1-1-4/mcs/class/System/System.CodeDom.Compiler/ChangeLog
===================================================================
--- branches/mono-1-1-4/mcs/class/System/System.CodeDom.Compiler/ChangeLog
2006-10-05 18:08:33 UTC (rev 66299)
+++ branches/mono-1-1-4/mcs/class/System/System.CodeDom.Compiler/ChangeLog
2006-10-05 18:10:24 UTC (rev 66300)
@@ -1,3 +1,19 @@
+2006-10-05 Wade Berrier <[EMAIL PROTECTED]>
+
+ * TempFileCollection.cs: Bring in changes from HEAD for serialization
+ security fix:
+ * r51229: Added a call to GC.SuppressFinalize in Dispose.
+ * r52181: Changed BasePath property to use Path.
+ GetTempPath (Environment check) and added the PathDiscovery check on
+ the combined result. Fixed TempDir so it's value never change (i.e.
+ imply that it doesn't need any permissions). Fixed SyncRoot to always
+ return null.
+ * r57836: Implement explicitly some interface methods to get rid of
+ the "!" errors on CorCompare.
+ * r60253: Make sure generated file names are unique. Fixes bug #76125
+ and #78230.
+ * r65441: Create files in a temporary subdirectory, for security
reasons.
+
2005-01-27 LLuis Sanchez Gual <[EMAIL PROTECTED]>
* CodeGenerator.cs: Write 'f' suffix for float constants.
Modified:
branches/mono-1-1-4/mcs/class/System/System.CodeDom.Compiler/TempFileCollection.cs
===================================================================
---
branches/mono-1-1-4/mcs/class/System/System.CodeDom.Compiler/TempFileCollection.cs
2006-10-05 18:08:33 UTC (rev 66299)
+++
branches/mono-1-1-4/mcs/class/System/System.CodeDom.Compiler/TempFileCollection.cs
2006-10-05 18:10:24 UTC (rev 66300)
@@ -5,9 +5,8 @@
// Dick Porter ([EMAIL PROTECTED])
//
// (C) Copyright 2003 Ximian, Inc.
+// Copyright (C) 2005 Novell, Inc (http://www.novell.com)
//
-
-//
// Permission is hereby granted, free of charge, to any person obtaining
// a copy of this software and associated documentation files (the
// "Software"), to deal in the Software without restriction, including
@@ -28,11 +27,18 @@
// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
//
+using System.Collections;
using System.IO;
-using System.Collections;
+using System.Security;
+using System.Security.Permissions;
+using System.Runtime.InteropServices;
-namespace System.CodeDom.Compiler
-{
+namespace System.CodeDom.Compiler {
+
+#if NET_2_0
+ [Serializable]
+#endif
+ [PermissionSet (SecurityAction.LinkDemand, Unrestricted = true)]
public class TempFileCollection:ICollection, IEnumerable, IDisposable
{
Hashtable filehash;
@@ -40,19 +46,22 @@
bool keepfiles;
string basepath;
Random rnd;
+ string ownTempDir;
- public TempFileCollection(): this(null, false)
+ public TempFileCollection ()
+ : this (String.Empty, false)
{
}
- public TempFileCollection(string tempDir): this(tempDir, false)
+ public TempFileCollection(string tempDir)
+ : this (tempDir, false)
{
}
public TempFileCollection(string tempDir, bool keepFiles)
{
filehash=new Hashtable();
- tempdir=tempDir;
+ tempdir = (tempDir == null) ? String.Empty : tempDir;
keepfiles=keepFiles;
}
@@ -60,22 +69,82 @@
{
get {
if(basepath==null) {
- if (tempdir==null) {
- /* Get the system temp dir */
- MonoIO.GetTempPath(out tempdir);
- }
-
+
if (rnd == null)
rnd = new Random ();
- string random = rnd.Next
(10000,99999).ToString ();
- basepath = Path.Combine (tempdir,
random);
+ // note: this property *cannot* change
TempDir property
+ string temp = tempdir;
+ if (temp.Length == 0)
+ temp = GetOwnTempDir ();
+
+ // Create a temporary file at the
target directory. This ensures
+ // that the generated file name is
unique.
+ FileStream f = null;
+ do {
+ int num = rnd.Next ();
+ num++;
+ basepath = Path.Combine (temp,
num.ToString("x"));
+ string path = basepath + ".tmp";
+
+ try {
+ f = new FileStream
(path, FileMode.CreateNew);
+ }
+ catch (System.IO.IOException) {
+ f = null;
+ continue;
+ }
+ catch {
+ // avoid endless loop
+ throw;
+ }
+ } while (f == null);
+
+ f.Close ();
+
+ // and you must have discovery access
to the combined path
+ // note: the cache behaviour is tested
in the CAS tests
+ if (SecurityManager.SecurityEnabled) {
+ new FileIOPermission
(FileIOPermissionAccess.PathDiscovery, basepath).Demand ();
+ }
}
return(basepath);
}
}
+
+ string GetOwnTempDir ()
+ {
+ if (ownTempDir != null)
+ return ownTempDir;
+ // this call ensure the Environment permissions check
+ string basedir = Path.GetTempPath ();
+
+ // Create a subdirectory with the correct user
permissions
+ int res = -1;
+ do {
+ int num = rnd.Next ();
+ num++;
+ ownTempDir = Path.Combine (basedir,
num.ToString("x"));
+ if (Directory.Exists (ownTempDir))
+ continue;
+ res = mkdir (ownTempDir, 0x1c0);
+ if (res != 0) {
+ if (!Directory.Exists (ownTempDir))
+ throw new IOException ();
+ // Somebody already created the dir,
keep trying
+ }
+ } while (res != 0);
+ return ownTempDir;
+ }
+
+ int ICollection.Count {
+ get {
+ return filehash.Count;
+ }
+ }
+
public int Count
{
get {
@@ -96,11 +165,9 @@
public string TempDir
{
get {
- if(tempdir==null) {
- return(String.Empty);
- } else {
- return(tempdir);
- }
+ // note: we only return what we were supplied
so there
+ // is no permission protecting this information
+ return tempdir;
}
}
@@ -133,7 +200,7 @@
object ICollection.SyncRoot {
get {
- return filehash.SyncRoot;
+ return null;
}
}
@@ -150,17 +217,33 @@
public void Delete()
{
- string[] filenames=new string[filehash.Count];
- filehash.Keys.CopyTo(filenames, 0);
+ bool allDeleted = true;
+ string[] filenames = new string[filehash.Count];
+ filehash.Keys.CopyTo (filenames, 0);
foreach(string file in filenames) {
if((bool)filehash[file]==false) {
File.Delete(file);
filehash.Remove(file);
- }
+ } else
+ allDeleted = false;
}
+ if (basepath != null) {
+ string tmpFile = basepath + ".tmp";
+ File.Delete (tmpFile);
+ basepath = null;
+ }
+ if (allDeleted && ownTempDir != null) {
+ Directory.Delete (ownTempDir, true);
+ ownTempDir = null;
+ }
}
+ IEnumerator IEnumerable.GetEnumerator ()
+ {
+ return(filehash.Keys.GetEnumerator());
+ }
+
public IEnumerator GetEnumerator()
{
return(filehash.Keys.GetEnumerator());
@@ -169,6 +252,9 @@
protected virtual void Dispose(bool disposing)
{
Delete();
+ if (disposing) {
+ GC.SuppressFinalize (true);
+ }
}
~TempFileCollection()
@@ -176,5 +262,6 @@
Dispose(false);
}
+ [DllImport ("libc")] private static extern int mkdir (string
olpath, uint mode);
}
}
_______________________________________________
Mono-patches maillist - [email protected]
http://lists.ximian.com/mailman/listinfo/mono-patches
