-
Notifications
You must be signed in to change notification settings - Fork 36
Open
Description
The generation of temporary filenames in index.js is insufficient to allow this library to be used in highly parallel environments where it is reasonable to expect that multiple processes may start on the same millisecond.
This happens regularly in our environment because two separate excel-stream processes generate the same temp file name and collide with each other:
Uncaught exception:
[Error: j: error parsing [...]\AppData\Local\Temp\_1474854568720: Error: Corrupted zip or bug : unexpected signature (\x2F\x2E\x72\x65, expected \x50\x4B\x03\x04)
]
Error: j: error parsing [...]\AppData\Local\Temp\_1474854568720: Error: Corrupted zip or bug : unexpected signature (\x2F\x2E\x72\x65, expected \x50\x4B\x03\x04)
at [...]\node_modules\excel-stream\index.js:49:34
at ConcatStream.<anonymous> ([...]\node_modules\excel-stream\node_modules\concat-stream\index.js:36:43)
at emitNone (events.js:72:20)
at ConcatStream.emit (events.js:166:7)
at finishMaybe ([...]\node_modules\excel-stream\node_modules\concat-stream\node_modules\readable-stream\lib\_stream_writable.js:475:14)
at afterWrite ([...]\node_modules\excel-stream\node_modules\concat-stream\node_modules\readable-stream\lib\_stream_writable.js:361:3)
at nextTickCallbackWithManyArgs (node.js:464:18)
at process._tickDomainCallback (node.js:403:17)
Temporary filename generation should be handled in a secure and standard way, such as that provided by the 'tmp' library.
Metadata
Metadata
Assignees
Labels
No labels