[Security] Predictable temp commit-message files in the shared tmpdir can collide or be pre-created by other local users

[404-Page-Found]

Description

Both commit() (src/git/diff.ts:240) and gitCommit() (src/commands/batch.ts:109) write the commit message to tmpdir()/commit-echo-msg-<pid>-<Date.now()>.txt using a guessable name (PID + millisecond timestamp) and default file permissions (writeFileSync(tmpFile, ..., 'utf-8'), mode 0666 & umask).

Issues:

1. Collision: two concurrent commit-echo processes started in the same millisecond (or two runs sharing a PID after reuse) write to the same path — one overwrites the other's message before git commit -F reads it.
2. TOCTOU/symlink: the world-writable tmpdir + predictable name means another local user can pre-create a file/symlink at the target path; the message is also world-readable if the umask permits.

Location

• src/git/diff.ts line 240
• src/commands/batch.ts line 109

Code

const tmpFile = join(tmpdir(), `commit-echo-msg-${process.pid}-${Date.now()}.txt`);
writeFileSync(tmpFile, fullMessage, 'utf-8');

Suggested fix

Use mkdtempSync(join(tmpdir(), 'commit-echo-')) or randomUUID() in the filename, and pass { mode: 0o600 } to writeFileSync. Alternatively pipe the message to git commit -F - via stdin, which avoids the temp file entirely.

Impact

Rare but real race conditions (wrong/empty commit messages under concurrency) and a local information-disclosure / file-precreation risk in a shared tmpdir.