Skip to content

v1.3.2 - marker subdir symlink guard

Choose a tag to compare

View all tags
@HetCreep HetCreep released this 15 Jul 16:18
v1.3.2
This tag was signed with the committer’s verified signature.
HetCreep
SSH Key Fingerprint: 0osv9sipbbl2qmrI00rRA3kcEKs4ZuS+FBihPD/c8DU
Verified
Learn about vigilant mode.
4172654
This commit was signed with the committer’s verified signature.
HetCreep
SSH Key Fingerprint: 0osv9sipbbl2qmrI00rRA3kcEKs4ZuS+FBihPD/c8DU
Verified
Learn about vigilant mode.

PATCH - security hardening follow-up: closes the dir-symlink residual the wx-latch left open. mkdirSync(recursive) silently follows a symlink pre-planted at the marker subdir (bypassing the 0o700 mode) - an lstatSync no-follow check now rejects a symlink subdir and fail-closes. Completes the CodeQL js/insecure-temporary-file mitigation. One-flock across CoalMine/CoalHearth/CoalFace. Tests green; verify PASS.

Assets 2
Loading