mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-14 10:52:17 +03:00
9095c2c31a
Both db-backups/exportAll and db-backups/export built temp paths from a
deterministic timestamp under os.tmpdir() and wrote into them without any
exclusive-creation guard. A local attacker could pre-place a symlink at the
predictable path; mkdirSync({recursive:true})/writeFileSync then silently
followed it (TOCTOU / symlink-following) instead of failing, redirecting the
backup write into an attacker-controlled location.
Replace both with fs.mkdtempSync (unique, exclusive, 0700) matching the
existing convention at src/mitm/systemCommands.ts:236-247. Cleanup now
removes the mkdtemp-created directory recursively on every path (success,
db.backup failure, request abort), instead of unlinking a single file.