Insecure file permissions while saving

[noktoborus]

Summary

It looks like a vulnerability. Helix should not rely on a properly installed umask or its equivalent in the OS being used. A temporary file for writing should be created with the most secure access rights.

Reproduction Steps

1. umask 0 (default umask usally is 022)
2. chmod 0600 10gb_sensitive_content.txt
3. hx 10gb_sensitive_content.txt
4. type :w in helix
5. while file saving ls -lha 10gb_sensitive_content.txt | cut -d' ' -f1

What I see: -rw-rw-rw-

Expected: -rw-------

After saving is completed permissions is as original file, e.g. -rw-------

Helix log

No response

Platform

Linux

Terminal Emulator

Alacritty

Installation Method

source

Helix Version

helix 24.7 (2a2bc79)

[pascalkuthe]

if I read the vim sourcode correctly its behaviour is the same.

[pascalkuthe]

actually nevermind, they do it directly while opening the file: https://github.com/vim/vim/blob/f4572cee35a6c224985e71116e676ab711c09af3/src/bufwrite.c#L1817.

We need to use opten options (and OpenOptionsExt)