🛡️ Sentinel: [HIGH] Fix predictable temp file symlink attack

[himattm]

🚨 Severity: HIGH
💡 Vulnerability: Predictable temporary file names (e.g., path + ".tmp") were used in world-writable directories (os.TempDir()) during atomic file writes in internal/sparkline/sparkline.go and internal/burnrate/burnrate.go. This allows malicious actors to create symlinks and overwrite arbitrary files because os.WriteFile follows symlinks.
🎯 Impact: Local privilege escalation or data corruption, as an attacker could pre-create a symlink with the predictable .tmp name pointing to a sensitive file, causing Prism to overwrite it.
🔧 Fix: Replaced the predictable path + ".tmp" logic with os.CreateTemp(filepath.Dir(path), filepath.Base(path)+".*.tmp"). Properly ensured the temporary file is created safely, has its permissions set to 0644 using f.Chmod(0644), and is explicitly closed before performing os.Rename.
✅ Verification: Verified that tests pass via go test ./... and the logic securely sets up unpredictable file names using os.CreateTemp.

---

PR created automatically by Jules for task 17575191897006099380 started by @himattm

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Code Review

This pull request mitigates symlink attack vulnerabilities by replacing predictable temporary filenames with os.CreateTemp in internal/burnrate/burnrate.go and internal/sparkline/sparkline.go. A sentinel documentation file was also added to record this security improvement. Feedback was provided regarding internal/sparkline/sparkline.go, where the error from os.Rename is currently ignored, potentially leading to leaked temporary files if the rename operation fails.

[gemini-code-assist]

The error from os.Rename is ignored here. Since os.CreateTemp generates a unique filename for every call, failing to rename the file will result in a leaked temporary file in the system's temp directory. Over time, this can lead to disk space exhaustion. You should handle the error and remove the temporary file if the rename fails, consistent with the implementation in internal/burnrate/burnrate.go.

if err := os.Rename(tmp, path); err != nil {
	os.Remove(tmp)
}

[himattm]

Closing as superseded by direct commit 42f3149 on main, which consolidated the burnrate/sparkline predictable-temp-file fixes and also preserved PR #82's updater temp-file hardening without the generated .jules note.

[google-labs-jules]

Closing as superseded by direct commit 42f3149 on main, which consolidated the burnrate/sparkline predictable-temp-file fixes and also preserved PR #82's updater temp-file hardening without the generated .jules note.

Understood. Acknowledging that this work is now obsolete and superseded by the direct commit on main, and stopping work on this task.