The "make check" tests use hardcoded filenames in /tmp, making "make check" vulnerable to symlink attacks (for systems that do not have special protection) in particular. For instance, create a symbolic link /tmp/test-trep-null-test.html to some existing file (with write permission). Then "make check" follows the symlink and overwrites this file. The test system should create a subdirectory of /tmp, make sure that the creation succeeded, and create all temporary files in it.
Erm these files are only created on devs' machines for testing, and travis which creates VMs from scratch. It would require a motivated dev to create symlinks in /tmp to sabotage their own machine. Who would do such a thing?
Not just on devs' machines, on any machine an end user wishes to build GnuCash, and such a machine may be a machine shared among several users.
