You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When opening files for writing, this package probably never wants to overwrite an existing file. This can be prevented (including any race conditions) by setting the O_CREAT O_EXCL flag when opening files for writing. This would potentially avoid any security vulnerabilities being discovered by package users resulting from malicious tar files overwriting important files.
The text was updated successfully, but these errors were encountered:
vtjnash
changed the title
security improvement: open files with O_CREAT for writing
security improvement: open files with O_EXCL for writing
Oct 25, 2022
Doesn't seem like we do. I guess I can use an internal open method, but maybe better to add an exclusive flag to the open function instead and then use it.
When opening files for writing, this package probably never wants to overwrite an existing file. This can be prevented (including any race conditions) by setting the
O_CREATO_EXCL flag when opening files for writing. This would potentially avoid any security vulnerabilities being discovered by package users resulting from malicious tar files overwriting important files.The text was updated successfully, but these errors were encountered: