1c306916aa
Some checks failed
Security / Security check (push) Failing after 1s
`hub_auth_token.dart` write() previously did
await f.writeAsString(token); // file is now 0644 (umask)
await Process.run('chmod', ['600', f.path]);
which leaves a TOCTOU window where the file is world-readable
between the writeAsString and the chmod call. On a multi-user
host another user could read the bearer token during that
window.
New flow:
await tmp.writeAsString(token); // .tmp file
await chmod(600, tmp.path); // restrict mode FIRST
await tmp.rename(f.path); // atomic POSIX rename
The destination is never visible with permissive perms. Also
sets `~/.fai/` itself to 0700 on Unix on first creation so
other users on a shared host can't enumerate the directory.
dart analyze clean; flutter test green (12 tests).
Bumped pubspec to 0.49.1.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
|
||
|---|---|---|
| .. | ||
| flow_output.dart | ||
| format.dart | ||
| friendly_error.dart | ||
| hub.dart | ||
| hub_auth_token.dart | ||
| registry_token.dart | ||
| system_actions.dart | ||
| theme_plugin.dart | ||
| today_story_loader.dart | ||