Makes use of tempfile.mktemp

[David]

Several modules in src/calibre/rtf2xml/ make use of tempfile.mktemp in an insecure fashion. This results in the code being vulnerable to Insecure temporary file. As an example ebooks/rtf2xml/pict.py uses mktemp in the __init__ constructor/method like this -->

self.__write_to = tempfile.mktemp()

and the self.__write_to is referenced later in process_pict, where it is opened like this --> (line 145)
            with open(self.__write_to, 'w') as write_obj:

and data is copied into the file (if it is to be copied)
via -->
copy_obj.copy_file(self.__write_to, "pict.data")
which ends up calling shutil.copyfile which will end up copying the pict.data file to the self.__write_to file location. As self.__write_to maybe a symbolic link, this may mean that another user file maybe over-written (e.g. ~/.bashrc).

[Kovid Goyal (kovid)]

Fixed in branch lp:calibre. The fix will be in the next release. calibre is usually released every Friday.

 status fixreleased