From 9698307f274d51b97691fdbe836c220a2a10bf18 Mon Sep 17 00:00:00 2001 From: Ziang Xie Date: Sat, 2 May 2026 00:40:44 +0800 Subject: [PATCH] fix(adapters): harden credential file storage in pairing.ts Three security improvements for adapters.json storage: - Use crypto.randomBytes for temp filename instead of predictable Date.now(), preventing TOCTOU symlink race during atomic write. - Enforce 0o600 permissions on adapters.json via writeFileSync mode option to prevent credential leakage via permissive umask. - Enforce 0o700 permissions on ~/.claude/ config directory via mkdirSync mode option. adapters.json contains sensitive credentials including Feishu app secrets and Telegram bot tokens. --- adapters/common/pairing.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/adapters/common/pairing.ts b/adapters/common/pairing.ts index 670b41fb..4cd8259f 100644 --- a/adapters/common/pairing.ts +++ b/adapters/common/pairing.ts @@ -58,9 +58,9 @@ function readConfigFile(): Record { function writeConfigFile(data: Record): void { const filePath = getConfigPath() const dir = path.dirname(filePath) - if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }) - const tmp = `${filePath}.tmp.${Date.now()}` - fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n', 'utf-8') + if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true, mode: 0o700 }) + const tmp = `${filePath}.tmp.${crypto.randomBytes(8).toString('hex')}` + fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n', { encoding: 'utf-8', mode: 0o600 }) fs.renameSync(tmp, filePath) }