GNU bug report logs - #49238
Ytfzf

Previous Next

Full log

View this message in rfc822 format

From: Maxime Devos <maximedevos <at> telenet.be>
To: Raghav Gururajan <rg <at> raghavgururajan.name>, 49238 <at> debbugs.gnu.org
Cc: jgart <jgart <at> dismail.de>
Subject: [bug#49238] [PATCH v3 2/2] gnu: Add ytfzf.
Date: Mon, 05 Jul 2021 14:02:20 +0200

[Message part 1 (text/plain, inline)]

Hi,

> +       (modify-phases %standard-phases
> +         (add-after 'unpack 'patch
> +           (lambda* (#:key inputs outputs #:allow-other-keys)
> +             (let* ((out (assoc-ref outputs "out"))
> +                    (binutils (assoc-ref inputs "binutils"))

The 'binutils' input doesn't seem to be used anywhere.


> +         if [ -n "$sub_list" ]; then
> +-            [ -n "$selected_sub" ] ||  selected_sub=$(printf "$sub_list" | eval "$menu_command") &&  youtube-dl  --sub-lang $selected_sub  --write-auto-sub --skip-download "$selected_urls" -o /tmp/ytfzf && YTFZF_SUBT_NAME="--sub-file=/tmp/ytfzf.$selected_sub.vtt" || printf "Auto generated subs not available."
> ++            [ -n "$selected_sub" ] ||  selected_sub=$(printf "$sub_list" | eval "$menu_command") &&  @youtube-dl@  --sub-lang $selected_sub  --write-auto-sub --skip-download "$selected_urls" -o /tmp/ytfzf && YTFZF_SUBT_NAME="--sub-file=/tmp/ytfzf.$selected_sub.vtt" || printf "Auto generated subs not available."

For a previous version of this patch series,
I noted that writing /tmp/ytfzf is quite possibly
insecure, and also incorrect on multi-user systems.

I don't see this addressed anywhere.

Greetings,
Maxime.

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.