Skip to content

Commit 634f8d0

Browse files
committed
Don't follow symlinks when writing htop_history
Prevent a symlink attack that allow any file where a user has write permission to be emptied. Signed-off-by: Kang-Che Sung <explorer09@gmail.com>
1 parent 1ebab17 commit 634f8d0

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

History.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ void History_save(const History* this) {
6969
if (!this->filename)
7070
return;
7171
/* Settings_write writes things via a temp file & rename, we do it less robust but faster here: */
72-
int fd = open(this->filename, O_WRONLY | O_CREAT | O_TRUNC, 0600);
72+
int fd = open(this->filename, O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW, 0600);
7373
if (fd == -1)
7474
return;
7575
FILE* fp = fdopen(fd, "w");

0 commit comments

Comments
 (0)