Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 9 Sep 2014 11:16:44 +0300
From: Mikko Korpela <>
To: "" <>
Subject: Re: pinocchio tmp vuln

This pinocchio sounds like a cool testing tool.

I have to say I don't understand at all why someone would be going
through random packages from PyPi (especially test automation related)
and searching for possible security issues.
Could someone explain why this kind of security issues (malicious user
making a symlink to some random file that is used during testing)
should be in the scope of test automation tools?

2014-09-09 9:26 GMT+03:00 David Jorm <>:
> On 09/09/2014 04:21 PM, Kurt Seifried wrote:
>> pinocchio       stopwatch       --with-stopwatch        Select tests based
>> on execution time
>> pinocchio-0.4.1/pinocchio/
>>      def finalize(self, result):
>>          """
>>          Save the recorded times, OR dump them into /tmp if the file
>>          open fails.
>>          """
>>          try:
>>              fp = open(self.stopwatch_file, 'w')
>>          except (IOError, OSError):
>>              t = int(time.time())
>>              filename = '/tmp/nose-stopwatch-%s.pickle' % (t,)
>> int(time.time) is easily guessed, create a few thousand and you're
>> covered for the next few hours and can stop anyone from using stopwatch,
>> or you can just blow away files as usual =).
>>              fp = open(filename, 'w')
>>              log.warning('WARNING: stopwatch cannot write to "%s"' %
>> (self.stopwatch_file))
>>              log.warning('WARNING: stopwatch is using "%s" to save times'
>> % (filename,))
>>          dump(self.times, fp)
>>          fp.close()
> You're a troll :)

Mikko Korpela

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.