gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-10 02:25:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix Windows installer delivery privacy check

Browse Source 
Change-source: pulse-maintainer
This commit is contained in:
pulse-triage[bot]
2026-09-01 18:55:06 +01:00
parent aee0ba5594
commit 8ca87e60bf
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/pulse-agent/collector_lifecycle.go
+8 -1
View File
@@ -13,6 +13,7 @@ import (
"time"
"github.com/rcourtman/pulse-go-rewrite/internal/collectorlifecycle"
internalsecurity "github.com/rcourtman/pulse-go-rewrite/internal/securityutil"
)
const (
@@ -84,7 +85,13 @@ func runCollectorLifecycleCommand(ctx context.Context, command string, args []st
return errors.New("collector-download-installer requires --url and an absolute --output path")
}
info, err := os.Lstat(*outputPath)
if err != nil || !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 || info.Mode().Perm()&0077 != 0 {
if err != nil || !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 {
return errors.New("collector-download-installer output must be a pre-created private regular file")
}
// Unix privacy is expressed by owner-only mode bits. Windows ignores
// those bits, so apply the same protected-DACL validation used for
// lifecycle credentials instead of rejecting every Windows output.
if err := internalsecurity.ValidatePrivatePath(*outputPath, info); err != nil {
return errors.New("collector-download-installer output must be a pre-created private regular file")
}
requestCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
cmd/pulse-agent/collector_lifecycle_test.go
+3
View File
@@ -123,6 +123,9 @@ func TestCollectorLifecycleCommandDownloadsInstallerThroughPublicTransport(t *te
if err := os.WriteFile(outputPath, nil, 0600); err != nil {
t.Fatal(err)
}
if err := internalsecurity.HardenPrivatePath(outputPath, 0600); err != nil {
t.Fatalf("harden installer output: %v", err)
}
var stdout, stderr bytes.Buffer
err := runCollectorLifecycleCommand(context.Background(), collectorDownloadInstallerCommand, []string{
"--url", server.URL,