vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-08-17 20:43:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix(security): fail on chmod error in github-auth.sh token persistence (#2375)

Browse source 
Remove `|| true` from chmod call that restricts token file permissions.
If chmod fails, authentication now aborts with an error instead of
silently leaving ~/.config/gh/hosts.yml world-readable.

Fixes #2374

Agent: security-auditor

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
A 2026-03-09 05:18:07 -07:00 • committed by GitHub
parent 882f404bb1
commit f23da1523b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
sh/shared/github-auth.sh
View file

@ -319,7 +319,10 @@ EOF
return 1
}
# Restrict token file permissions to owner-only (prevents exposure on multi-user systems)
chmod 600 "${HOME}/.config/gh/hosts.yml" 2>/dev/null || true
chmod 600 "${HOME}/.config/gh/hosts.yml" || {
log_error "Failed to restrict token file permissions — aborting to prevent credential exposure"
return 1
}
export GITHUB_TOKEN="${_gh_token}"
elif gh auth status &>/dev/null; then
log_info "Authenticated with GitHub CLI"