On 2015-12-02, Jörn Engel <[email protected]> wrote: > The vim bug is to try "$TMPDIR" even though the environment variable > isn't set. Arguably that could become a security-issue if I can create > a "$TMPDIR" in a directory I control and trick someone else to open a > file from that directory.
If it were possible to trick someone to open an existing file in the temporary directory, that'd be a problem even under normal circumstances, since /tmp (/var/tmp, /usr/tmp, etc, all typical values for TMPDIR) is world-writable. > So independently of what praise you might > want to heap on my fuse-thing, vim is equally at fault here. Vim isn't opening a file that exists, it is trying to find a file that doesn't exist. Which means it can't be tricked into opening a file that exists. -- -- You received this message from the "vim_dev" maillist. Do not top-post! Type your reply below the text you are replying to. For more information, visit http://www.vim.org/maillist.php --- You received this message because you are subscribed to the Google Groups "vim_dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
