Potential TOCTOU Attack Surface

[nevercodecorrect]

Hello,
In the code here, the conf_path file priviledge is changed after the creation and data writing. A malicious attacker could perform TOCTOU attack to read/write the data before the priviledge changing if he knows the timing of the program execution. This is similar to the CVE-2022-23651 that the file permission is changed a bit late. There are also other instances of the same issue in the same file.

[VirtuBox]

Hello @nevercodecorrect,
Thanks for your report.
So to fix this issue, WordOps should set file priviledge before writing data into files ?

[nevercodecorrect]

that could be one way. You could also directly give permissions at creation time like below which is also the fix to that known cve

fd = os.open(
            self.filename,
            flags=os.O_RDWR | os.O_CREAT,
            mode=stat.S_IRUSR | stat.S_IWUSR,
        )
 os.close(fd)

[VirtuBox]

Thanks for your report @nevercodecorrect, I'm going to work on this issue.

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions]

This issue was closed because it has been stalled for 5 days with no activity.

[VirtuBox]

Fix will be available soon

[VirtuBox]

@nevercodecorrect Does this seem correct to you? 31353f0

[nevercodecorrect]

Yes this looks correct