{"action":"created","issue":{"url":"https://api.github.com/repos/defuse/php-encryption/issues/134","labels_url":"https://api.github.com/repos/defuse/php-encryption/issues/134/labels{/name}","comments_url":"https://api.github.com/repos/defuse/php-encryption/issues/134/comments","events_url":"https://api.github.com/repos/defuse/php-encryption/issues/134/events","html_url":"https://github.com/defuse/php-encryption/issues/134","id":112630954,"number":134,"title":"Look for TOCTTOU bugs in File","user":{"login":"defuse","id":4211072,"avatar_url":"https://avatars.githubusercontent.com/u/4211072?v=3","gravatar_id":"","url":"https://api.github.com/users/defuse","html_url":"https://github.com/defuse","followers_url":"https://api.github.com/users/defuse/followers","following_url":"https://api.github.com/users/defuse/following{/other_user}","gists_url":"https://api.github.com/users/defuse/gists{/gist_id}","starred_url":"https://api.github.com/users/defuse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/defuse/subscriptions","organizations_url":"https://api.github.com/users/defuse/orgs","repos_url":"https://api.github.com/users/defuse/repos","events_url":"https://api.github.com/users/defuse/events{/privacy}","received_events_url":"https://api.github.com/users/defuse/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/defuse/php-encryption/labels/SECURITY","name":"SECURITY","color":"e11d21"},{"url":"https://api.github.com/repos/defuse/php-encryption/labels/v2.0","name":"v2.0","color":"006b75"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/defuse/php-encryption/milestones/2","html_url":"https://github.com/defuse/php-encryption/milestones/v2.0%20release","labels_url":"https://api.github.com/repos/defuse/php-encryption/milestones/2/labels","id":1360010,"number":2,"title":"v2.0 release","description":"","creator":{"login":"defuse","id":4211072,"avatar_url":"https://avatars.githubusercontent.com/u/4211072?v=3","gravatar_id":"","url":"https://api.github.com/users/defuse","html_url":"https://github.com/defuse","followers_url":"https://api.github.com/users/defuse/followers","following_url":"https://api.github.com/users/defuse/following{/other_user}","gists_url":"https://api.github.com/users/defuse/gists{/gist_id}","starred_url":"https://api.github.com/users/defuse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/defuse/subscriptions","organizations_url":"https://api.github.com/users/defuse/orgs","repos_url":"https://api.github.com/users/defuse/repos","events_url":"https://api.github.com/users/defuse/events{/privacy}","received_events_url":"https://api.github.com/users/defuse/received_events","type":"User","site_admin":false},"open_issues":19,"closed_issues":22,"state":"open","created_at":"2015-10-16T18:26:44Z","updated_at":"2015-10-21T16:41:02Z","due_on":"2015-10-31T06:00:00Z","closed_at":null},"comments":4,"created_at":"2015-10-21T16:41:02Z","updated_at":"2015-10-30T18:52:07Z","closed_at":null,"body":"The `File` encryption and decryption make heavy use of `ftell()` to measure file sizes and get the current position within the file. Does this make it vulnerable to any sort of TOCTTOU attacks? \r\n\r\nSome ideas:\r\n\r\n- What if we've opened a file in read-only mode and some other process has it open in append-only mode, and the size changes after we've measured it?\r\n- Others?\r\n\r\nWhat guarantees does \"the operating system\" provide once we have a file resource? Note that \"the operating system\" is *every* operating system PHP runs on, so we have to look at the lowest common denominator."},"comment":{"url":"https://api.github.com/repos/defuse/php-encryption/issues/comments/152615531","html_url":"https://github.com/defuse/php-encryption/issues/134#issuecomment-152615531","issue_url":"https://api.github.com/repos/defuse/php-encryption/issues/134","id":152615531,"user":{"login":"paragonie-scott","id":11591518,"avatar_url":"https://avatars.githubusercontent.com/u/11591518?v=3","gravatar_id":"","url":"https://api.github.com/users/paragonie-scott","html_url":"https://github.com/paragonie-scott","followers_url":"https://api.github.com/users/paragonie-scott/followers","following_url":"https://api.github.com/users/paragonie-scott/following{/other_user}","gists_url":"https://api.github.com/users/paragonie-scott/gists{/gist_id}","starred_url":"https://api.github.com/users/paragonie-scott/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paragonie-scott/subscriptions","organizations_url":"https://api.github.com/users/paragonie-scott/orgs","repos_url":"https://api.github.com/users/paragonie-scott/repos","events_url":"https://api.github.com/users/paragonie-scott/events{/privacy}","received_events_url":"https://api.github.com/users/paragonie-scott/received_events","type":"User","site_admin":false},"created_at":"2015-10-30T18:52:06Z","updated_at":"2015-10-30T18:52:06Z","body":"Could we abstract everything into a stream object? Keep track of the file size and position without relying on `ftell()` etc.?"}}