Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

os: format readme, fix markdown inside html #21286

Merged
merged 2 commits into from
Apr 15, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 17 additions & 17 deletions vlib/os/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,22 +4,20 @@
command line arguments, reading/writing files, listing folders,
handling processes etc.

* * *

---

### Security advice related to TOCTOU attacks

A few `os` module functions can lead to the <b>TOCTOU</b> vulnerability if used incorrectly.
<b>TOCTOU</b> (Time-of-Check-to-Time-of-Use problem) can occur when a file, folder or similar
is checked for certain specifications (e.g. read, write permissions) and a change is made
afterwards.
In the time between the initial check and the edit, an attacker can then cause damage.
The following example shows an attack strategy on the left and an improved variant on the right
so that <b>TOCTOU</b> is no longer possible.

A few `os` module functions can lead to the **TOCTOU** vulnerability if used incorrectly.
**TOCTOU** (Time-of-Check-to-Time-of-Use problem) can occur when a file, folder or similar
is checked for certain specifications (e.g. read, write permissions) and a change is made
afterwards.
In the time between the initial check and the edit, an attacker can then cause damage.
The following example shows an attack strategy on the left and an improved variant on the right
so that **TOCTOU** is no longer possible.

<b>Example</b>
<i>Hint</i>: `os.create()` opens a file in write-only mode
**Example** <br>
*Hint*: `os.create()` opens a file in write-only mode

<table>
<tr>
Expand All @@ -39,6 +37,7 @@ if os.is_writable("file") {
f.close()
}
```

</td>
<td>

Expand All @@ -52,14 +51,15 @@ mut f := os.create('path/to/file') or {

f.close()
```

</td>
</tr>
</table>

<b> Proven affected functions </b></br>
**Proven affected functions** <br>
The following functions should be used with care and only when used correctly.

* os.is_readable()
* os.is_writable()
* os.is_executable()
* os.is_link()
- os.is_readable()
- os.is_writable()
- os.is_executable()
- os.is_link()