romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-14 18:31:42 +03:00
Code Issues Projects Releases Packages Wiki Activity

fopen: for temp files, inherit permissions only for owner

Browse source 
When creating a temp file in order to later replace an original, copying
over the existing permissions can not be considered safe when the user
running libcurl is not the owner of the existing file.

Closes #21092
This commit is contained in:
Stefan Eissing 2026-03-25 10:35:28 +01:00 • committed by Daniel Stenberg
parent eac64c1879
commit 8deaf04feb
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/curl_fopen.c
View file

@ -103,7 +103,14 @@ CURLcode Curl_fopen(struct Curl_easy *data, const char *filename,
return CURLE_OK;
}
curlx_fclose(*fh);
#ifdef HAVE_GETEUID
/* If the existing file is not owned by the user, do not inherit
* its permissions at the temp file created below. The permissions
* might be unsuitable for holding user private data. */
if(sb.st_uid != geteuid())
sb.st_mode = 0;
#endif
#endif /* !_WIN32 */
*fh = NULL;
result = Curl_rand_alnum(data, randbuf, sizeof(randbuf));