From f23da1523b8194c3900fd248effa22017a2c3e72 Mon Sep 17 00:00:00 2001 From: A <258483684+la14-1@users.noreply.github.com> Date: Mon, 9 Mar 2026 05:18:07 -0700 Subject: [PATCH] fix(security): fail on chmod error in github-auth.sh token persistence (#2375) Remove `|| true` from chmod call that restricts token file permissions. If chmod fails, authentication now aborts with an error instead of silently leaving ~/.config/gh/hosts.yml world-readable. Fixes #2374 Agent: security-auditor Co-authored-by: B <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.5 --- sh/shared/github-auth.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sh/shared/github-auth.sh b/sh/shared/github-auth.sh index 1665758f..57b940e1 100755 --- a/sh/shared/github-auth.sh +++ b/sh/shared/github-auth.sh @@ -319,7 +319,10 @@ EOF return 1 } # Restrict token file permissions to owner-only (prevents exposure on multi-user systems) - chmod 600 "${HOME}/.config/gh/hosts.yml" 2>/dev/null || true + chmod 600 "${HOME}/.config/gh/hosts.yml" || { + log_error "Failed to restrict token file permissions — aborting to prevent credential exposure" + return 1 + } export GITHUB_TOKEN="${_gh_token}" elif gh auth status &>/dev/null; then log_info "Authenticated with GitHub CLI"