René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"A more intuitive fs.mkdtemp()","articleBody":"\u003c!--\r\nThanks for wanting to report an issue you've found in Node.js. Please fill in\r\nthe template below by replacing the html comments with an appropriate answer.\r\nIf unsure about something, just do as best as you're able.\r\n\r\nversion: `5.10.1`\r\nplatform:  `Darwin 15.3.0`\r\nsubsystem:  `fs`\r\n\r\nIt will be much easier for us to fix the issue if a test case that reproduces\r\nthe problem is provided. Ideally this test case should not have any external\r\ndependencies. We understand that it is not always possible to reduce your code\r\nto a small test case, but we would appreciate to have as\r\nmuch data as possible.\r\n\r\nThank you!\r\n--\u003e\r\n- **Version**: `5.10.1`\r\n- **Platform**: `Darwin 15.3.0`\r\n- **Subsystem**:  `fs`\r\n\r\n\u003c!-- Enter your issue details below this comment. --\u003e\r\n\r\nI am happy that the Node team decided to implement `fs.mkdtemp()` - the security concerns around this behavior make me glad to see it in core.\r\n\r\nHowever, the API feels awkward to me because:\r\n- The randomness it provides is hard coded to 6 characters, which is just enough that it's _probably fine_, but not enough that I don't want to add more.\r\n- Using the `prefix` argument sounds like a good way to add random characters, but doing half the work is strange if you read code that actually does this. Additionally, _if_ I'm going to implement my own name pattern, I don't really want to _also_ have to keep in mind the one Node is using. For example, should I have to re-implement the entire `mkdtemp` just to get valid [UUIDv4](https://en.wikipedia.org/wiki/Universally_unique_identifier#Version_4_.28random.29) directory names? That is genuinely useful for unit tests and also for being able to easily `mv` the temporary directory to a cache-proof URL on my server without \"renaming\" it ... lest I have to undo the suffix every time or teach my client code about it.\r\n- Using `prefix` as a directory path is messy, What would you expect this code to do?\r\n  \r\n  ``` javascript\r\n  'use strict';\r\n  \r\n  const os = require('os');\r\n  const fs = require('fs');\r\n  \r\n  fs.mkdtemp(os.tmpdir(), (err, dir) =\u003e {\r\n      if (err) {\r\n          throw err;\r\n      }\r\n      console.log('Created directory:', dir);\r\n  });\r\n  ```\r\n  \r\n  If `os.tmpdir()` returns `/tmp` for you, that will actually create a directory at the very root of your filesystem, rather than inside of `/tmp`. And it will end up being named something like `tmp-e0ew3m`. To \"fix\" this you have to use `path.join(os.tmpdir(), '/')`.\r\n\r\nI would like to propose making the API more intuitive and useful for its intended purpose: unique, convenient, secure creation of temporary directories.\r\n1. Have an explicit `cwd` argument, which is internally `path.join()`'d with the name. This is so that the name can be computed in isolation. And to prevent accidentally creating directories out in the open, where they won't actually be cleaned up.\r\n2. Replace `prefix` with (or just add) a `name` option, which is used as-is when provided. Possibly increase the default randomness for the case where one is not provided. This makes it easy to opt-out of the pattern that Node happens to use currently, which is not exposed via any kind of constant (and I don't think that would provide much value, anyway).\r\n\r\nI think these changes are best done as a breaking change, mainly to make the API less surprising. But compatibility could probably be maintained by only enabling these semantics on the options object.\r\n","author":{"url":"https://github.com/sholladay","@type":"Person","name":"sholladay"},"datePublished":"2016-04-11T04:45:47.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":4},"url":"https://github.com/6142/node/issues/6142"}