Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

curl_fopen optimization #11419

Closed
wants to merge 3 commits into from
Closed

curl_fopen optimization #11419

wants to merge 3 commits into from

Conversation

SaltyMilk
Copy link
Contributor

No description provided.

github-advanced-security[bot]
github-advanced-security bot found potential problems Jul 10, 2023
View reviewed changes
lib/fopen.c
*fh = fopen(filename, FOPEN_WRITETEXT);
if(*fh)
return CURLE_OK;
*fh = fopen(filename, FOPEN_WRITETEXT);

Check failure

Code scanning / CodeQL

File created without restricting permissions

A file may be created here with mode 0666, which would make it world-writable.
@gvanem
Copy link
Contributor

gvanem commented Jul 10, 2023

No description provided.

WTF? A PR should describe the motivation behind a change. And so what's the optimization here?

bagder
bagder reviewed Jul 11, 2023
View reviewed changes
lib/fopen.c Outdated
goto fail;
}
if (fstat(fileno(*fh), &sb) == -1 || !S_ISREG(sb.st_mode))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

make checksrc will tell you that we don't use spaces after if...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My apologies for the oversight, fixed in next commit.

@SaltyMilk
Copy link
Contributor Author

Last commit notes:

  • make checksrc ✅
  • Added 0600 on the fopen to silence code-scanning warning.

@bagder
Copy link
Member

bagder commented Jul 11, 2023

Added 0600 on the fopen to silence code-scanning warning.

That's not how fopen() works (it would require the use of open()). The warning is wrong.

@SaltyMilk
Copy link
Contributor Author

Sorry about that, another oversight in rush. I believe this should be good to go now.
I'll be more careful for potential future PRs, sorry !

@bagder bagder closed this in 0c66718 Jul 11, 2023
@bagder
Copy link
Member

bagder commented Jul 11, 2023

Thanks!

bch pushed a commit to bch/curl that referenced this pull request Jul 19, 2023
@SaltyMilk @bch
fopen: optimize
b2e6bb4 
Closes curl#11419
@wangdudu321123
Copy link

【高危漏洞】CVE-2023-32001 url 存在 fopen 竞争条件漏洞

ptitSeb pushed a commit to wasix-org/curl that referenced this pull request Sep 25, 2023
@SaltyMilk @ptitSeb
fopen: optimize
dca9be1 
Closes curl#11419
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bagder bagder bagder approved these changes

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@SaltyMilk @gvanem @bagder @wangdudu321123