fix(disk-hygiene): check ownership of the no-interpreter notice marker before trusting it
维护者通常 1 天内回复
评估
调研方向
Locate the disk-hygiene code that latches the once-per-session no-interpreter notice via ${TMPDIR:-/tmp}/disk-hygiene-guard-no-interpreter/ (including the extra reader added for the Stop monitor). Before trusting or writing that marker, verify the path is a directory owned by the current user and is not a symlink; otherwise treat the notice as not yet shown. The guard must still fail closed. Confirm with the related #6225/#6311 hygiene paths that another user cannot silence the notice by pre-creating the directory or a symlink.
由索引模型根据 Issue 内容生成。
描述
Problem
When no Python interpreter is found, disk-hygiene latches its once-per-session notice through a fallback marker directory, ${TMPDIR:-/tmp}/disk-hygiene-guard-no-interpreter/. Another local user can pre-create that directory, or a symlink in its place, and silence the notice for every session. It cannot turn a deny into an allow: the guard still fails closed. The exposure predates #6225; the #6225 disk-hygiene PR (#6311) adds one more reader of the marker (the Stop monitor).
Found by the security review on #6311 (P5).
Expected
Before trusting or writing the marker, check that the directory is owned by the current user and is not a symlink. Otherwise, treat the notice as not yet shown.
Related
#6225, #6311.
- 主要语言
- Shell
- 星标
- 22
- 派生
- 2
- 平均合并
- 8 小时 24 分钟
- 30 天内合并 PR
- 947
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
melodic-software/claude-code-plugins 的其他 Issue
-
needs-human needs-triage priority: medium
难度 2/5 1-3 小时 新手友好度 65/100
melodic-software/claude-code-plugins#7455 · 1 条评论 ·
维护者通常 1 天内回复
-
priority: medium
难度 2/5 1-3 小时 新手友好度 68/100
melodic-software/claude-code-plugins#7351 · 2 条评论 ·
维护者通常 1 天内回复
-
agent-ready priority: high work-class: scoped
难度 2/5 1-3 小时 新手友好度 74/100
melodic-software/claude-code-plugins#7312 · 3 条评论 ·
维护者通常 1 天内回复
-
priority: medium
难度 2/5 1-3 小时 新手友好度 76/100
melodic-software/claude-code-plugins#7288 · 2 条评论 ·
维护者通常 1 天内回复
-
knowledge: docpage-digest dual verification defines no verdict vocabulary or pass/fail threshold未关闭needs-human
难度 2/5 1-3 小时 新手友好度 78/100
melodic-software/claude-code-plugins#7286 · 2 条评论 ·
维护者通常 1 天内回复
查看 melodic-software/claude-code-plugins 的全部 Issue
相似的 Issue
-
area:install bug needs-triage
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 2 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 62/100
Netcracker/qubership-test-pipelines#307 ·
维护者通常 2 天内回复
-
Webcam overlay freezes during voxtype dictation while screen recording (pause_media pauses the overlay mpv)可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 65/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 62/100
TYPO3BestPractices/tea#2409 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 62/100
msys2/MSYS2-packages#6825 ·
维护者通常 1 天内回复