Re: Issue #1204: Document, and add regtest for, external fonts. (issue 557640051 by address@hidden)

[v . villenave]

On 2020/03/30 18:56:27, thomasmorley651 wrote:
> tmpnam is deprecated in guile-3.0.2

(sigh) Nice catch!

> Why introducing it, we would need to move away from it later anyway?

Well, I *would* have used mkstemp, but I need to create a directory
(rather than a file), and there’s no mkdtemp in Guile.  Plus, I wanted
the code to be supported by both Guile 1.8 and 2.  Plus, we’re already
using tmpnam somewhere else in the codebase.  Plus…

> Also, the link you provided speaks about security risks...

Yes, so I’ve seen.  I certainly *can* imagine how that could be
exploited in a critical case.  (And by letting users have access to a
Turing-complete language within LilyPond files, our exposure to security
faults is already quite wide.)  Then again, that’s a regtest we’re
talking about, not a snippet or a doc example, not something we’re
actively encouraging people to do at home.

Frankly, if anyone can think of a solution to do the exact same thing
with mkstemp (and to remove the temporary files after compilation), I’m
all ears.  As of right now, I know I can’t :-)

V.

https://codereview.appspot.com/557640051/