config.SetToken: chmod-after-write exposes token with default permissions #591

New issue

Closed

opened 2026-08-07 18:36:24 +00:00 by the.auditor · 1 comment

the.auditor commented

2026-08-07 18:36:24 +00:00

Owner

config.SetToken writes the config file via viper (WriteConfig) and only then applies os.Chmod(path, 0o600). The file is created with default umask-based permissions, leaving a window where the plaintext token is world-readable to local observers.

Write to a temp file, chmod 0600, then rename into place (atomic), or create the file with 0600 upfront.

See #588

`config.SetToken` writes the config file via viper (`WriteConfig`) and only then applies `os.Chmod(path, 0o600)`. The file is created with default umask-based permissions, leaving a window where the plaintext token is world-readable to local observers. Write to a temp file, chmod 0600, then rename into place (atomic), or create the file with 0600 upfront. See https://git.lan.thwap.org/thwap/thwap-pagesd/pulls/588

the.auditor added the

Kind/Security

Priority

High

labels

2026-08-07 18:36:36 +00:00

automation referenced this issue

2026-08-07 19:36:09 +00:00

feat(tpagectl): implement credential management #588

automation referenced this issue

2026-08-11 01:29:32 +00:00

fix(tpagectl): address CLI issues #634

automation closed this issue

2026-08-11 01:30:03 +00:00

automation commented

2026-08-11 01:30:04 +00:00

Owner

Already resolved in PR #588: writeConfig creates the temp file with 0o600 upfront (os.OpenFile mode), then renames it over the target — no chmod-after-write window. Verified during the CLI-lump pass; closing without further change.

Already resolved in PR #588: `writeConfig` creates the temp file with `0o600` upfront (os.OpenFile mode), then renames it over the target — no chmod-after-write window. Verified during the CLI-lump pass; closing without further change.