Skip to content

fix(cli): harden hook settings atomic write - #150

Closed
tachyon-beep wants to merge 1 commit into
mainfrom
codex/propose-fix-for-symlink-vulnerability-pr0x33
Closed

fix(cli): harden hook settings atomic write#150
tachyon-beep wants to merge 1 commit into
mainfrom
codex/propose-fix-for-symlink-vulnerability-pr0x33

Conversation

@tachyon-beep

Copy link
Copy Markdown
Collaborator

Motivation

  • Prevent a symlink-clobber/file-poisoning primitive where a predictable PID-based staging filename inside .claude could be pre-created as a symlink by a malicious repository and redirect writes outside the project.

Description

  • Replace the predictable .settings.json.tmp-<pid> staging path with an exclusive, randomized temporary file created via tempfile::Builder::tempfile_in in the .claude directory and atomically persist it to settings.json using persist, avoiding following attacker symlinks.
  • Remove the previous fs::write + fs::rename flow and implement write_and_swap(dir, dest, serialized) which creates, writes, and persists the temp file safely.
  • Promote tempfile from a test-only dev-dependency to a runtime dependency in crates/loomweave-cli/Cargo.toml so secure temp-file creation is available at runtime.
  • Add a Unix regression test install_does_not_follow_predictable_staging_symlink that pre-places the old predictable symlink and verifies the external target is not modified and the installed settings.json is a regular file.

Testing

  • Ran cargo test -p loomweave-cli hooks_settings, and all relevant tests passed (20 passed, 0 failed), including the new symlink regression test.
  • Ran cargo fmt --check and git diff --check, both of which succeeded with no reported issues.
  • Verified changes in crates/loomweave-cli/src/hooks_settings.rs and crates/loomweave-cli/Cargo.toml and committed the patch as the branch update.

Codex Task

Copilot AI lite review requested due to automatic review settings September 1, 2026 18:58
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens loomweave-cli’s .claude/settings.json update path to prevent a symlink-clobber primitive by replacing the predictable PID-based staging filename with an exclusive, randomized temp file and persisting it atomically.

Changes:

  • Replace .settings.json.tmp-<pid> staging with tempfile::Builder::tempfile_in + persist() for atomic swap.
  • Promote tempfile from a dev-dependency to a runtime dependency for loomweave-cli.
  • Add a Unix regression test ensuring a pre-seeded predictable staging symlink does not redirect writes.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
crates/loomweave-cli/src/hooks_settings.rs Switch to randomized, exclusive temp-file staging + add symlink regression test.
crates/loomweave-cli/Cargo.toml Move tempfile to runtime dependencies.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment on lines +316 to +320
fn write_and_swap(dir: &Path, dest: &Path, serialized: &str) -> Result<()> {
let mut tmp = tempfile::Builder::new()
.prefix(".settings.json.tmp-")
.tempfile_in(dir)
.with_context(|| format!("create staging file in {}", dir.display()))?;
@tachyon-beep

Copy link
Copy Markdown
Collaborator Author

Superseded by the rebase onto release/1.6.0, which also widens the fix to the other five staging sites of the same class and keeps umask-derived file modes.

@tachyon-beep
tachyon-beep deleted the codex/propose-fix-for-symlink-vulnerability-pr0x33 branch September 1, 2026 20:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants