Summary
The upgrade path downloads the installer script into a string and writes it to a temp script with default file permissions.
Evidence
src/CodeIndex/Cli/ProgramRunner.cs fetches https://raw.githubusercontent.com/Widthdom/CodeIndex/main/install.sh with client.GetStringAsync(...).GetAwaiter().GetResult() and then writes it using File.WriteAllText(scriptPath, script).
Impact
The response body can be larger than expected before the process notices, and the temporary script can be more broadly readable than necessary on shared systems. This is separate from existing issues about pinning/verifying the installer and bounding the installer runtime.
Suggested fix
Stream the response with an explicit byte limit, fail closed on over-limit downloads, and create the temp script with owner-only permissions where supported.
Summary
The upgrade path downloads the installer script into a string and writes it to a temp script with default file permissions.
Evidence
src/CodeIndex/Cli/ProgramRunner.csfetcheshttps://raw.githubusercontent.com/Widthdom/CodeIndex/main/install.shwithclient.GetStringAsync(...).GetAwaiter().GetResult()and then writes it usingFile.WriteAllText(scriptPath, script).Impact
The response body can be larger than expected before the process notices, and the temporary script can be more broadly readable than necessary on shared systems. This is separate from existing issues about pinning/verifying the installer and bounding the installer runtime.
Suggested fix
Stream the response with an explicit byte limit, fail closed on over-limit downloads, and create the temp script with owner-only permissions where supported.