-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Closed
Labels
bugDid we break something?Did we break something?
Description
- Potentially affects shared cache group logic which can be a security issue?
- Affects all local commands that create directories which is also a security issue.
**For example: **
dvc get https://github.com/iterative/dataset-registry get-started/data.xml -o data/data.xml
creates an intermediate directory data with 0o777 permissions on Mac in ~ and /tmp:
drwxrwxrwx 3 ivan wheel 96B Nov 13 12:47 data
It might be related to this note:
Changed in version 3.7: The mode argument no longer affects the file permission bits of newly-created intermediate-level directories.
It also can be reproduced on Linux. More context here - https://discordapp.com/channels/485586884165107732/565699007037571084/644272213331279872
Metadata
Metadata
Assignees
Labels
bugDid we break something?Did we break something?