bernardo/Nomarchy
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(scripts): use mktemp for state.json writes, not a fixed /tmp path
All checks were successful
Check / eval-and-lint (push) Successful in 6m57s
Details

Browse Source 
Ten state-mutating sites across seven scripts wrote through a predictable,
world-writable temp path (`/tmp/state.json`, `/tmp/system-state.json`)
before the atomic `sudo mv`. Because the `>` redirect runs as the invoking
user (sudo doesn't cover redirects), the shared fixed path is a symlink/
TOCTOU target and collides if two of these run concurrently. Switch each
to a per-invocation `mktemp`; the atomic rename into place is unchanged.
nomarchy-theme-set already used a temp var for its home-state write — this
makes its system-state write consistent and cleans the temp up on failure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Bernardo Magri
2026-05-30 21:05:04 +01:00
parent 95d36f8ec7
commit dc9e74ca12
7 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/system/scripts/nomarchy-setup-dns
View File

@@ -14,7 +14,7 @@ fi
case "$dns" in
Cloudflare|Google|DHCP)
sudo jq --arg dns "$dns" '.dns = $dns' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
tmp=$(mktemp); sudo jq --arg dns "$dns" '.dns = $dns' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
;;
Custom)
@@ -28,7 +28,7 @@ Custom)
# Convert to JSON array safely
dns_array=$(echo "$dns_servers" | jq -R 'split(" ")')
sudo jq --arg dns "Custom" --argjson servers "$dns_array" '.dns = $dns | .customDns = $servers' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
tmp=$(mktemp); sudo jq --arg dns "Custom" --argjson servers "$dns_array" '.dns = $dns | .customDns = $servers' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
;;
esac