hashgraph / hashgraph/full-stack-testing

helm executable extracted to temporary directory is globally writable.

Open
#965 0 comments 0 reactions 0 assignees View on GitHub
Bug Pending Triage
Dominant language
Java
Stars
9
Forks
3
PR merge metrics
No merged PRs in 30d

Description

### Bill of Materials or CLI Version

_No response_

### Execution Environment

JUnit Extensions

### Slf4j Logging Implementation

None

### To Reproduce

```markdown
Use helm client, inspect temporary directory with name such as `HelmSoftwareLoader4512790602684642253` containing globally writable helm executable.
```

### Describe the bug

`helm` executable is extracted as globally writable file.

### Describe the expected behavior

Extracted executable does not need to be writable, especially not be group or world.

### Whole JUnit/CLI Logs

```shell
N/A
```

### Additional Context

_No response_

Contributor guide

Open the contributing guide

Research direction

Locate HelmSoftwareLoader and the code that extracts the helm executable into its temporary directory. Reproduce the extraction and inspect the resulting file permissions, then verify the fix with the relevant JUnit extension tests; done means the executable is not group- or world-writable.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, java
Domain
devops, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.