CVE-2021-3701

An attacker with local access to the system can exploit the predictable temporary directory path (`.ansible-runner` in the system temp directory) or the race between deletion and reuse of a `TemporaryDirectory` name. By pre-creating the directory with world-writable permissions before ansible-runner uses it, the attacker can cause ansible-runner to write files into an attacker-controlled location, potentially reading private information or forcing writes as the legitimate user. This is a TOCTOU race condition combined with incorrect default permissions [CWE-276].

The vulnerability is in `ansible_runner/config/_base.py` and `ansible_runner/streaming.py`. In `_base.py`, when no `private_data_dir` is provided, the code used `os.path.join(gettempdir(), ".ansible-runner")` — a fixed, predictable path — and then called `os.makedirs(..., exist_ok=True, mode=0o700)` on it. In `streaming.py`, the code used `tempfile.TemporaryDirectory().name` which creates a tempdir, immediately exposes its name, and then deletes it, allowing an attacker to pre-create a directory with that same name.

The patch replaces the fixed path `os.path.join(gettempdir(), ".ansible-runner")` with `tempfile.mkdtemp(prefix=".ansible-runner-")`, which creates a uniquely-named temporary directory atomically, eliminating the predictability that enabled the race. In `streaming.py`, `tempfile.TemporaryDirectory().name` is replaced with `tempfile.mkdtemp()`, avoiding the delete-then-recreate window. Additionally, `os.makedirs(self.private_data_dir, exist_ok=True, mode=0o700)` is moved inside the `if private_data_dir:` branch so it only runs when the user explicitly provides a path, not on the auto-generated one.