vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-04-28 03:49:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

fix(security): restrict temp file permissions in send_matrix_email (#3239)

Browse source 
Set umask 077 before mktemp so the temp .ts file is created with 0600
permissions, preventing other users on shared systems from reading it.
Umask is restored immediately after file creation.

Agent: code-health

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
A 2026-04-08 01:33:34 -07:00 • committed by GitHub
parent 7e44923fb9
commit 1745b78689
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
sh/e2e/e2e.sh
View file

@ -576,8 +576,11 @@ send_matrix_email() {
done
done
local ts_file
local ts_file old_umask
old_umask=$(umask)
umask 077
ts_file=$(mktemp /tmp/e2e-email-XXXXXX.ts)
umask "${old_umask}"
cat > "${ts_file}" << 'TS_EOF'
const results = (process.env._E2E_RESULTS ?? "").split(",").filter(Boolean);