Skip to content

1.0.127

Choose a tag to compare

View all tags
@nictuku nictuku released this 23 Sep 17:01
· 1 commit to main since this release
1.0.127
d5eacee
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security: fixes GHSA-prmg-4fr3-mm6x — the cached long-lived Meta access token was written to a 0644 file inside a 0755 directory under the usual umask, so any other local user could read it. Operators who ran an earlier version on a shared host should rotate the token; upgrading repairs the permissions but does not undo prior exposure.

What's changed

  • fix(security): the token cache file is created with os.open(..., O_CREAT, 0o600) and its directory with mode 0o700, and both are narrowed explicitly afterwards — which also repairs a cache written by an earlier version (#167).
  • The same narrowing runs when a cache is loaded, so an existing install stops being world-readable as soon as the server starts, with no need to re-authenticate. The chmod step is skipped on Windows, where access is governed by ACLs.

Full changelog: 1.0.126...1.0.127

Assets 2
Loading