src/sage/misc/latex.py: replace tmp_dir() #36436
Conversation
These bits of code only use one temporary file, but they call a function _run_latex_() that writes its output file to the same directory as its input file. Since we don't want the output path to be predictable (for security reasons), we have to "hide" the one temporary file inside of a temporary directory that will only be writable by the Sage user. In other words: standard tempfile.TemporaryDirecrory() replacement. Issue: sagemath#36322
This is less error-prone than calling cleanup() manually, although it results in a much larger diff.
The context manager is better but it makes the diff awful if you have to indent the entire method. I've made the change in a separate commit if you don't mind looking through it though. |
|
Documentation preview for this PR (built with commit 0c4578f; changes) is ready! 🎉 |
|
@mezzarobba: do you have any remaining concerns? This looks good to me. |
No. I thought I had approved the changes, but apparently I made a mistake? |
sagemathgh-36436: src/sage/misc/latex.py: replace tmp_dir() These bits of code only use one temporary file, but they call a function `_run_latex_()` that writes its output file to the same directory as its input file. Since we don't want the output path to be predictable (for security reasons), we have to "hide" the one temporary file inside of a temporary directory that will only be writable by the Sage user. In other words: standard `tempfile.TemporaryDirecrory()` replacement. Issue: sagemath#36322 URL: sagemath#36436 Reported by: Michael Orlitzky Reviewer(s): Marc Mezzarobba
|
This bungles I opened #36526. |
These bits of code only use one temporary file, but they call a function
_run_latex_()that writes its output file to the same directory as its input file. Since we don't want the output path to be predictable (for security reasons), we have to "hide" the one temporary file inside of a temporary directory that will only be writable by the Sage user.In other words: standard
tempfile.TemporaryDirecrory()replacement.Issue: #36322