mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-21 06:12:17 +03:00
60931fc8f9
adobeFireflySession.ts and adobeFireflyBrowserLogin.ts persisted the IMS Bearer JWT and full Adobe cookie jar to disk via mkdirSync/writeFileSync with no mode argument, so directories and files inherited the process umask (0755/0644) instead of the 0700/0600 pattern already established by src/lib/vncSession/service.ts::createProfileDir. Adds a shared open-sse/utils/secureFileWrite.ts (ensureSecureDir/writeSecureFile) used by both Adobe modules, and applies it at every directory-creation and session/cookie-jar write call site.
26 lines
1.1 KiB
TypeScript
26 lines
1.1 KiB
TypeScript
/**
|
|
* Shared helpers for persisting credential/session material (tokens, cookie jars) to disk
|
|
* with restrictive permissions — 0700 directories, 0600 files — instead of inheriting the
|
|
* process umask (typically 0755/0644).
|
|
*
|
|
* Mirrors the established pattern in src/lib/vncSession/service.ts::createProfileDir.
|
|
* `chmodSync` is applied even on an already-existing directory so a dir created before this
|
|
* hardening (or by any looser writer) is tightened rather than silently trusted.
|
|
*/
|
|
|
|
import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
|
|
|
|
const SECURE_DIR_MODE = 0o700;
|
|
const SECURE_FILE_MODE = 0o600;
|
|
|
|
/** Create `dir` (recursively) with 0700 permissions, tightening it if it already exists. */
|
|
export function ensureSecureDir(dir: string): void {
|
|
mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
|
|
chmodSync(dir, SECURE_DIR_MODE);
|
|
}
|
|
|
|
/** Write `data` to `path` as utf8 with 0600 permissions. */
|
|
export function writeSecureFile(path: string, data: string): void {
|
|
writeFileSync(path, data, { encoding: "utf8", mode: SECURE_FILE_MODE });
|
|
}
|