Fixed directory names in public temporary directory

[Mattia Rizzolo]

Originally reported in https://bugs.debian.org/919489

when i use "File»Import Clip Art…", inkscape creates the following
tree of directories with fixed names:

0 dkg@alice:~$ find $TMPDIR/openclipart -ls
  3043836 0 drwxr-xr-x 4 dkg dkg 80 Jan 16 10:33 /home/dkg/tmp/openclipart
  3043838 0 drwxr-xr-x 2 dkg dkg 40 Jan 16 10:33 /home/dkg/tmp/openclipart/images
  3043837 0 drwxr-xr-x 2 dkg dkg 40 Jan 16 10:33 /home/dkg/tmp/openclipart/thumbnails
0 dkg@alice:~$

if $TMPDIR is unset, this happens in the globally-fixed name /tmp/openclipart

I've tried having one user account ("attacker") create
/tmp/openclipart as a symlink to somewhere inside another user
("victim")'s home directory. when the victim user opens inkscape and
chooses "File»Import Clip Art…" it creates the arbitrarily-named
directories "images" and "thumbnails" on their behalf.

This abuse of fixed names in /tmp is a security issue.

I can reproduce it with 1.0alpha.

[Martin Owens (doctormo)]

Hi - thanks for reporting this bug, I've manually migrated it to Inkscape's new
bug tracker on GitLab, and closed it here.

Please feel free to file new bugs about the issues you're seeing at
http://inkscape.org/report.

Moved to: https://gitlab.com/inkscape/inbox/issues/263
Closed by: https://gitlab.com/doctormo