🛡️ Sentinel: [MEDIUM] Fix local state file permissions - #82
Conversation
Enforce strict permissions on the `.polyagent` directory (`0o700`) and the `state.json` file (`0o600`) to prevent local information disclosure. Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1f00582ecb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 }); | ||
| const data: StateFile = { sessions: this.sessions }; | ||
| writeFileSync(this.path, JSON.stringify(data, null, 2)); | ||
| writeFileSync(this.path, JSON.stringify(data, null, 2), { mode: 0o600 }); |
There was a problem hiding this comment.
When an existing installation already has ~/.polyagent/state.json with its former permissions (typically 0644) and .polyagent as 0755, these mode options do not change them: mkdirSync(..., { recursive: true }) ignores the mode for an existing directory, and writeFileSync preserves an existing file's mode. Consequently, upgrading and saving state leaves the sensitive file readable by other local users indefinitely; explicitly chmod the existing directory and file as part of the save/migration path.
Useful? React with 👍 / 👎.
1 participant
🚨 Severity: MEDIUM
💡 Vulnerability
The
StateStoreclass was persisting local agent session data (in~/.polyagent/state.json) using the default Node.js file permissions (which are typically affected by the system's umask, often leaving files world-readable). This file could contain sensitive session identifiers, agent prompt text, or task paths.🎯 Impact
A local attacker (or another user on the same system) could read the
state.jsonfile, potentially gaining access to sensitive task data, source code paths, or active session handles that the user was currently interacting with via the polyagent CLI.🔧 Fix
Updated
src/state.tsto explicitly provide restrictive permissions when persisting the local state store:mkdirSyncnow usesmode: 0o700(rwx for user only).writeFileSyncnow usesmode: 0o600(rw- for user only).✅ Verification
pnpm test(all 35 tests pass).#Correct#.PR created automatically by Jules for task 3392351303251740534 started by @parvezk