tpagectl: stored API token is world-readable (0644 config file) #586

New issue

Closed

opened 2026-08-07 14:35:06 +00:00 by the.auditor · 1 comment

the.auditor commented

2026-08-07 14:35:06 +00:00

Owner

config.SetToken in internal/tpagectl/config/config.go writes the API token via viper's WriteConfig, whose default configPermissions is 0o644 (confirmed in viper.go:198). The token therefore lands in a world-readable plaintext file.

Even though OS keychain storage is deferred to #257, the interim config-file storage should restrict permissions. Suggested fix: call v.SetConfigPermissions(0o600) before WriteConfig (and/or os.Chmod(path, 0o600) after writing).

Ref: PR #585

`config.SetToken` in `internal/tpagectl/config/config.go` writes the API token via viper's `WriteConfig`, whose default `configPermissions` is `0o644` (confirmed in viper.go:198). The token therefore lands in a world-readable plaintext file. Even though OS keychain storage is deferred to #257, the interim config-file storage should restrict permissions. Suggested fix: call `v.SetConfigPermissions(0o600)` before `WriteConfig` (and/or `os.Chmod(path, 0o600)` after writing). Ref: PR #585

the.auditor added the

Kind/Security

Priority

High

labels

2026-08-07 14:35:11 +00:00

automation referenced this issue

2026-08-11 01:29:32 +00:00

fix(tpagectl): address CLI issues #634

automation closed this issue

2026-08-11 01:29:59 +00:00

automation commented

2026-08-11 01:30:00 +00:00

Owner

Already resolved in PR #588: writeConfig (internal/tpagectl/config/config.go) writes to a same-directory temp file opened with 0o600 and renames it over the target, so the config file — and any plaintext token — is never world-readable. Verified during the CLI-lump pass; closing without further change.

Already resolved in PR #588: `writeConfig` (internal/tpagectl/config/config.go) writes to a same-directory temp file opened with `0o600` and renames it over the target, so the config file — and any plaintext token — is never world-readable. Verified during the CLI-lump pass; closing without further change.