mirrors/kitty
1
0
Fork 0
mirror of https://github.com/kovidgoyal/kitty synced 2026-06-06 01:05:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

dnd kitten: Create regular files with O_EXCL to avoid symlink attacks

Browse Source 
This is not really needed as the terminal emulator should be de
duplicating directory entries anyway but no harm in defense in depth.
This commit is contained in:
Kovid Goyal
2026-06-03 12:17:38 +05:30
parent 4aa4a5c056
commit 8996aa798c
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
kittens/dnd/drop.go
View File

@@ -823,7 +823,7 @@ func (dnd *dnd) on_remote_drop_data(cmd DC) (err error) {
e.item_type = cmd.Xp
switch cmd.Xp {
case 0:
f, err := utils.CreateAt(e.base_dir.handle, e.name, 0o666)
f, err := utils.CreateExclusiveAt(e.base_dir.handle, e.name, 0o666)
if err != nil {
return err
}

6
tools/utils/file_at_fd.go
View File

@@ -79,6 +79,12 @@ func CreateAt(dirFile *os.File, name string, permissions os.FileMode) (*os.File,
return openAt(dirFile, name, unix.O_RDWR|unix.O_CREAT|unix.O_TRUNC, permissions)
}
// CreateExclusiveAt creates a file relative to the directory pointed to by
// dirFile. Fails if a directory entry with the same name already exists.
func CreateExclusiveAt(dirFile *os.File, name string, permissions os.FileMode) (*os.File, error) {
return openAt(dirFile, name, unix.O_RDWR|unix.O_CREAT|unix.O_EXCL, permissions)
}
// Create the specified directory, open it and return the file object. If the
// directory already exists, it is opened and returned, without changing its
// permissions, matching the behavior of CreateAt().