Skip to content

Commit

Permalink
Make tempfile unreadable to secure
Browse files Browse the repository at this point in the history
Doing it twice. Why? Because but infraspec send_file doesn't have an interface
to set mode nor owner. Also it doesn't guarantee to keep file mode when
overwriting existing file.
  • Loading branch information
sorah committed Mar 14, 2016
1 parent 438d79e commit 7af1d29
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions lib/itamae/resource/file.rb
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,11 @@ def send_tempfile
end

@temppath = ::File.join(runner.tmpdir, Time.now.to_f.to_s)

run_command(["touch", @temppath])
run_specinfra(:change_file_mode, @temppath, '0600')
backend.send_file(src, @temppath)
run_specinfra(:change_file_mode, @temppath, '0600')
ensure
f.unlink if f
end
Expand Down

0 comments on commit 7af1d29

Please sign in to comment.