Skip to content

Commit

Permalink
Fix permissions
Browse files Browse the repository at this point in the history
  • Loading branch information
Kidev committed Jan 6, 2025
1 parent b37b7c0 commit e079088
Showing 1 changed file with 18 additions and 8 deletions.
26 changes: 18 additions & 8 deletions aqt/installer.py
Original file line number Diff line number Diff line change
Expand Up @@ -1463,7 +1463,7 @@ class CommercialInstaller:
"installationErrorWithCancel": frozenset({"Retry", "Ignore", "Cancel"}),
"installationErrorWithIgnore": frozenset({"Retry", "Ignore"}),
"AssociateCommonFiletypes": frozenset({"Yes", "No"}),
"telemetry": frozenset({"Yes", "No"}),
"telemetry-question": frozenset({"Yes", "No"}),
}

def __init__(
Expand Down Expand Up @@ -1633,12 +1633,21 @@ def _get_install_command(self, installer_path: Path) -> list[str]:
raise ValueError("Empty credentials")
cmd.extend(["--email", self.username, "--pw", self.password])

# Validate installation directory
# Validate and create installation directory if needed
if self.output_dir:
resolved_output = str(Path(self.output_dir).resolve(strict=True))
if not resolved_output:
raise ValueError("Invalid output directory")
cmd.extend(["--root", resolved_output])
output_path = Path(self.output_dir)
try:
# Create all parent directories if they don't exist
output_path.mkdir(parents=True, exist_ok=True)
# Resolve the path after creation
resolved_output = str(output_path.resolve())
if not resolved_output:
raise ValueError("Invalid output directory")
cmd.extend(["--root", resolved_output])
except PermissionError as e:
raise ValueError(f"Permission denied creating output directory: {e}")
except OSError as e:
raise ValueError(f"Error creating output directory: {e}")

# Build auto-answer options with enhanced validation
auto_answers = []
Expand Down Expand Up @@ -1692,10 +1701,11 @@ def install(self) -> None:
)

with tempfile.TemporaryDirectory(prefix="qt_install_") as temp_dir:
# Create temp dir with restricted permissions
# Create temp dir with appropriate permissions
temp_path = Path(temp_dir)
if hasattr(os, "chmod"):
os.chmod(temp_dir, 0o500) # Read and execute for owner only
# Allow read/write/execute for owner (7), no permissions for group/others (0)
os.chmod(temp_dir, 0o700)

Check warning on line 1708 in aqt/installer.py

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

aqt/installer.py#L1708

These permissions `0o700` are widely permissive and grant access to more people than may be necessary.

installer_path = temp_path / self.installer_filename

Expand Down

0 comments on commit e079088

Please sign in to comment.