Repository navigation
Make doit.log, the crawl logs and the progress lock owner-only - #2001
Merged
Merged
Conversation
doit.log, hts-log.txt, hts-err.txt and hts-in_progress.lock echo the command line, which can hold a password from a URL, a -%X header or a proxy option. Under umask 022 all of them came out 0644. They now open through hts_fopen_private(), the cookie jar's open moved to htslib.c. It creates the file 0600 and fchmods an existing one before the first write. Windows keeps the folder's ACL. Test 658 checks the modes after a crawl, after an --update over 0644 files, and for the lock while a crawl runs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Review round 1 of #2001. hts-ioinfo.txt, hts-cache/new.txt, new.zip and WebHTTrack's winprofile.ini also hold passwords, so they now open through hts_fopen_private(). It moves to htslines.c, which htsserver also compiles, and it refuses any mode but "w" and "wb". Test 658 now runs a self-test that reads the mode before the first write. It checks hts-err.txt and the files above, and it holds a crawl on a trickling page so the lock is always there to read. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
xroche
changed the title
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On POSIX, doit.log, hts-log.txt, hts-err.txt, hts-ioinfo.txt, the progress lock, the cache's new.txt and new.zip, and WebHTTrack's winprofile.ini are now owner-only, because each can hold passwords. They use the cookie jar's open helper, now
hts_fopen_private(), which also tightens an old doit.log that an earlier run left at 0644.