ashpie/swaf
1
0
Fork 0
Code Issues 22 Pull Requests Releases 11 Wiki Activity

Enforce config file permissions

Browse Source
This commit is contained in:
Alice Gaudon 2020-07-15 15:13:40 +02:00
parent 9ce345d99d
commit 249098a587
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/Application.ts
View File

@ -11,6 +11,8 @@ import {Type} from "./Utils";
import LogRequestsComponent from "./components/LogRequestsComponent"; import LogRequestsComponent from "./components/LogRequestsComponent";
import {ValidationBag} from "./db/Validator"; import {ValidationBag} from "./db/Validator";
import config from "config"; import config from "config";
import * as fs from "fs";
import SecurityError from "./SecurityError";
import TemplateError = lib.TemplateError; import TemplateError = lib.TemplateError;
export default abstract class Application { export default abstract class Application {
@ -177,6 +179,16 @@ export default abstract class Application {
} }
private async checkSecuritySettings(): Promise<void> { private async checkSecuritySettings(): Promise<void> {
// Check config file permissions
for (const file of fs.readdirSync('config')) {
const stats = fs.lstatSync(file);
if (stats.uid !== process.getuid())
throw new SecurityError(file + ' is not owned by this process (' + process.getuid() + ').');
if (stats.mode !== 400)
throw new SecurityError(file + ' is not chmod 400.');
}
// Check security fields
for (const component of this.components) { for (const component of this.components) {
await component.checkSecuritySettings(); await component.checkSecuritySettings();
} }