Development record
dataDirHazard refuses a world-writable plugin data directory or cache subdirectory, but not a group-writable one or one owned by another uid, so on a shared host a group member or another account can still supply the cache artefact and its recorded hash the hazard check claims to rule out. It should apply the caller-alone test the home-scoped declarations use (not writable by group or other, owned by this uid).
issueresolvedminoriss-2609260057111315
dataDirHazard refuses a world-writable plugin data directory or cache subdirectory, but not a group-writable one or one owned by another uid, so on a shared host a group member or another account can still supply the cache artefact and its recorded hash the hazard check claims to rule out. It should apply the caller-alone test the home-scoped declarations use (not writable by group or other, owned by this uid).
Grounds
- pursued: only a directory the caller alone can write supplies the owned PATH copy; TestDataDirHazardRefusesAnyoneElsesDirectory and TestInstallIgnoresGroupWritableDataCache would fail if a 0775 or foreign-owned data dir were accepted, and the declaration tests would fail if the extraction changed ReadDeclaration
Frontmatter
| id | iss-2609260057111315 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2609260057111315-datadirhazard-refuses-a-world-writable.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2609261636074260The build loop's worktree step proves each level of the machine-scoped worktree store (~/.abcd, worktrees, <root-sha>) a real directory through fsutil.EnsureRealDirAll but never applies fsutil.CallersAlone, so a pre-existing store level owned by another uid, or writable by group or other (mode 0777), is accepted and the lane's worktree is added into it, where another account could replace the checkout the implementer works in. Each existing level should be held to the caller-alone test the home-scoped declarations and the harness data directory use (iss-2609260057111315), and a level the step creates made 0700.