Administrator/Multi-Hoster-Upload
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 262 Wiki Activity

fix(gateway): write the token registry with owner-only permissions (0600)

Browse Source 
registry.json holds each server's bearer token (the connection secret). It was
written with the process default umask, leaving it group/world-readable on POSIX
multi-user hosts. Write with mode 0o600 and chmod the existing file (writeFile
only applies mode on creation). No-op on Windows (NTFS uses ACLs, and the file
already sits under the user profile and is gitignored), effective on Linux/macOS
where the gateway may run.

Gateway-only change — not part of the app installer or auto-updater, so no
version bump.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Administrator 2026-06-19 17:57:39 +02:00
parent 20b53f9587
commit 602e48cb01
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
gateway/registry.js
View File

@ -1,4 +1,4 @@
import { readFile, writeFile } from 'node:fs/promises'; import { readFile, writeFile, chmod } from 'node:fs/promises';
import { fileURLToPath } from 'node:url'; import { fileURLToPath } from 'node:url';
import { dirname, join } from 'node:path'; import { dirname, join } from 'node:path';
@ -20,7 +20,8 @@ export async function loadRegistry() {
export async function saveRegistry(registry) { export async function saveRegistry(registry) {
const data = registry && typeof registry === 'object' ? registry : {}; const data = registry && typeof registry === 'object' ? registry : {};
await writeFile(REGISTRY_PATH, JSON.stringify(data, null, 2) + '\n', 'utf8'); await writeFile(REGISTRY_PATH, JSON.stringify(data, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
try { await chmod(REGISTRY_PATH, 0o600); } catch {}
} }
export async function upsertEntry(entry) { export async function upsertEntry(entry) {