[Security] Harden permissions of .env files#7677
Conversation
Updated `writeFile` to support an optional `mode` parameter and explicitly call `chmod` to ensure permissions are applied even if the file already exists. Used `mode: 0o600` for `.env` files in `writeDotEnv` and `pullEnv` to prevent unauthorized access to sensitive API secrets. Added regression tests for `writeFile` permissions.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
github-actions
Bot
added
the
no-changelog
Differences in type declarationsWe detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:
New type declarationsWe found no new type declarations in this PR Existing type declarationspackages/cli-kit/dist/public/node/fs.d.ts@@ -86,6 +86,7 @@ export declare function appendFile(path: string, content: string): Promise<void>
export declare function appendFileSync(path: string, data: string): void;
export interface WriteOptions {
encoding: BufferEncoding;
+ mode?: number | string;
}
/**
* Writes content to file at path.
|
1 participant
This PR hardens the security of
.envfiles created or updated by the Shopify CLI by ensuring they have restrictive file permissions (0o600).Key changes:
writeFileutility incli-kitto support amodeparameter.chmodinwriteFileafter writing the file. This ensures that permissions are correctly set even for files that already existed with broader permissions..envfile writing logic inwriteDotEnvandpullEnvto use0o600(readable/writable only by the owner).writeFilecorrectly applies permissions on POSIX systems.Security: Prevents other local users on the same system from reading sensitive environment variables like
SHOPIFY_API_SECRET.PR created automatically by Jules for task 11733830971334597419 started by @gonzaloriestra