security/fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 35 Wiki Activity

sandbox: do not ensure symlink target
All checks were successful
Test / Create distribution (push) Successful in 25s
Details
Test / Fortify (push) Successful in 2m40s
Details
Test / Fpkg (push) Successful in 3m29s
Details
Test / Data race detector (push) Successful in 4m31s
Details
Test / Flake checks (push) Successful in 1m4s
Details

Browse Source 
This masks EEXIST on target and might clobber filesystems and lead to other confusing behaviour. Create its parent instead.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-03-25 19:30:53 +09:00
parent b39f3aeb59
commit 33940265a6
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
1 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sandbox/sequential.go
View File

@ -303,10 +303,7 @@ func (l *Symlink) apply(*Params) error {
}
target := toSysroot(l[1])
if err := ensureFile(target, 0444, 0755); err != nil {
return err
}
if err := os.Remove(target); err != nil {
if err := os.MkdirAll(path.Dir(target), 0755); err != nil {
return msg.WrapErr(err, err.Error())
}
if err := os.Symlink(l[0], target); err != nil {