Path Manipulation about gtm-session-fetcher HOT 2 CLOSED

I'm having a hard time following what the issue is, and from the screen shot, it sounds like the core of the problem might lie is some other package that then calls GTMSessionFetcher. At it's core, GTMSessionFetcher, when downloading to a file, has to be told where to download too. If that fails, it needs to cleanup any partial download. GTMSessionFetcher does not require running with any escalated file system privileges, so the only things it can modify are what the parent app (that the developer control) is allowing access too.

From the look of the end of the report, it seems like it might be saying the data in question comes from "FCNUserDefaultsManager", that is not part of GTMSessionFetcher, so it sound like that might actually be where you are saying there is an issue. If that can be comprised, then anything it calls could be attacked, and there is nothing things it calls (like GTMSessionFetcher) can really do to recover from something already compromised on the system doing bad things. I'd suggest moving this issue to whatever component is responsible for that class.

from gtm-session-fetcher.

Actually, rereading the code on our end, the UploadFetcher only does a remove when it is using a temporary file, and the api points don't directly allow someone to control the selection of the temp file name - we use a UUID to generate the name and NSTemporaryDirectory() to get the directory.

from gtm-session-fetcher.