@@ -48,7 +48,24 @@ function execSync(cmd, opts, pipe) {
4848stderrFile :stderrFile ,
4949} ;
5050
51- fs . writeFileSync ( paramsFile , JSON . stringify ( paramsToSerialize ) , 'utf8' ) ;
51+ // Create the files and ensure these are locked down (for read and write) to
52+ // the current user. The main concerns here are:
53+ //
54+ // * If we execute a command which prints sensitive output, then
55+ // stdoutFile/stderrFile must not be readable by other users.
56+ // * paramsFile must not be readable by other users, or else they can read it
57+ // to figure out the path for stdoutFile/stderrFile and create these first
58+ // (locked down to their own access), which will crash exec() when it tries
59+ // to write to the files.
60+ function writeFileLockedDown ( filePath , data ) {
61+ fs . writeFileSync ( filePath , data , {
62+ encoding :'utf8' ,
63+ mode :parseInt ( '600' , 8 ) ,
64+ } ) ;
65+ }
66+ writeFileLockedDown ( stdoutFile , '' ) ;
67+ writeFileLockedDown ( stderrFile , '' ) ;
68+ writeFileLockedDown ( paramsFile , JSON . stringify ( paramsToSerialize ) ) ;
5269
5370var execArgs = [
5471path . join ( __dirname , 'exec-child.js' ) ,
@@ -91,6 +108,7 @@ function execSync(cmd, opts, pipe) {
91108}
92109
93110// No biggie if we can't erase the files now -- they're in a temp dir anyway
111+ // and we locked down permissions (see the note above).
94112try { common . unlinkSync ( paramsFile ) ; } catch ( e ) { }
95113try { common . unlinkSync ( stderrFile ) ; } catch ( e ) { }
96114try { common . unlinkSync ( stdoutFile ) ; } catch ( e ) { }