mirror of
https://github.com/PR0M3TH3AN/SeedPass.git
synced 2026-10-27 07:52:03 +00:00
google-labs-jules[bot]andPR0M3TH3AN
bee0d6235a
This change replaces insecure file writes followed by `os.chmod` with `utils.atomic_write.atomic_write` in `portable_backup.py` and `manager.py`. The `atomic_write` function uses `tempfile.mkstemp` to ensure files are created with restrictive permissions (0o600) from the start, eliminating the race condition where sensitive data could be briefly world-readable. - Updated `export_backup` in `portable_backup.py` to use `atomic_write` for both the JSON backup and its encrypted counterpart. - Updated `handle_export_totp_codes` in `manager.py` to use `atomic_write` for TOTP exports. - Added `test_atomic_write_perms.py` to verify permissions behavior (though it relies on system-specific `mkstemp` behavior). - Verified fix by running existing tests `test_portable_backup.py`, `test_export_totp_codes.py`, and `test_atomic_write.py`. Co-authored-by: PR0M3TH3AN <[email protected]>
35 lines
761 B
Python
35 lines
761 B
Python
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
# Add src/utils to path to import atomic_write directly
|
|
sys.path.append(str(Path("src/utils").resolve()))
|
|
|
|
from atomic_write import atomic_write
|
|
import os
|
|
import stat
|
|
|
|
def test_atomic_write_permissions():
|
|
test_file = Path("test_permissions.txt")
|
|
if test_file.exists():
|
|
test_file.unlink()
|
|
|
|
def write_op(f):
|
|
f.write("content")
|
|
|
|
atomic_write(test_file, write_op)
|
|
|
|
st = test_file.stat()
|
|
mode = stat.S_IMODE(st.st_mode)
|
|
print(f"File permissions: {oct(mode)}")
|
|
|
|
if mode == 0o600:
|
|
print("SUCCESS: Permissions are 0o600")
|
|
else:
|
|
print(f"FAILURE: Permissions are {oct(mode)}")
|
|
|
|
test_file.unlink()
|
|
|
|
if __name__ == "__main__":
|
|
test_atomic_write_permissions()
|