Skip to content

Conversation

@arpitjain099
Copy link

  • I understand that this repository is auto-generated and my pull request may not be merged

Changes being requested

Fixes #1618

Extracting files from a malicious tar archive without validating that the destination file path is within the destination directory can cause files outside the destination directory to be overwritten, due to the possible presence of directory traversal elements (..) in archive paths.

Alert: Overly permissive file permissions

Current Issue: The current file permission is set to 0o755, which allows the owner to read, write, and execute the file, while the group and others can read and execute it.
Recommended Fix: Change the file permission to 0o700, which allows only the owner to read, write, and execute the file, thereby restricting access to others.
Code to change:

Original code

os.chmod(target_path, 0o755) 

Recommended fix

os.chmod(target_path, 0o700) 

This change ensures that the file permissions are restricted, enhancing security by preventing unauthorized users from accessing the file.

Additional context & links

@arpitjain099 arpitjain099 requested a review from a team as a code owner August 8, 2024 05:38
@RobertCraigie
Copy link
Collaborator

Thanks for the PR but this is not worth changing. #1618 (comment)

@arpitjain099 arpitjain099 changed the title Update permissions to make it less restrictive Update permissions to make it more restrictive Aug 18, 2024
@arpitjain099
Copy link
Author

@RobertCraigie I choose to differ and would request for a re-review. CodeQL consistently marks this issue as a high severity warning.
image

@RobertCraigie
Copy link
Collaborator

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

2 participants