[m-rev.] for review: Improve Mercury's temporary files and directories predicates.

Sebastian Godelet sebastian.godelet at outlook.com
Wed Apr 13 13:47:32 AEST 2016


Hi Paul,

> I don't really know C# and have even less knowledge of Erlang.  I've not
> implemented these for the Erlang backend and a reviewer may wish to
> scrutinze the C# code in particular.
> +        DirName = Path.Combine(Dir, Path.GetRandomFileName());
> +        /*
> +         * This is not secure:
> +         *   1. We cannot set permissions
There is an overload which allows you to specify the security
var securityRules = new DirectorySecurity();
// apply something like 600 here
Directory.CreateDirectory(path, securityRules);
> +         *   2. We cannot atomically test for and create a directory
This Path.GetRandomFileName() should create a unique and secure (cannot be guessed) path, so we don't need to test for existence.
But CreateDirectory will actually do the test for you and returns the information using a DirectoryInfo object.
We could check if this complies with the required security permissions or rely on .NET exceptions thrown (UnauthorizedAccessException)
> +         */
> +        Directory.CreateDirectory(DirName);
> +        Error = 0;
> +        ErrorMessage = """";

cheers,

Sebastian.



More information about the reviews mailing list