mrdevel2002-ui opened a new pull request, #3411: URL: https://github.com/apache/tika/pull/3411
FileBasedConfigStore, the `configStoreType: file` backend behind tika-grpc component management and shared pipes workers, writes `config-store.json` through a sibling `.tmp` created with the process umask, and the atomic rename publishes those bits. Under the default 022 umask every saved fetcher and emitter config is therefore readable by any other local account, and that store is exactly where resolved credentials end up: S3 `secretKey`, HTTP `password` and `jwtSecret`, Azure `sasToken`, Graph `clientSecret` (the configuration docs note that a persistent store receives the resolved configurations). `saveToFile` now creates the `.tmp` as `rw-------` on POSIX filesystems before writing it, so the rename publishes an owner-only file; filesystems without POSIX permissions keep today's behavior. The new test in `ConfigStoreTest` saves credential-bearing configs through the store and asserts the file is owner-only with no `.tmp` left behind; it fails on main (`GROUP_READ, OTHERS_READ` present) and passes here, and `clean install` of tika-pipes-core (221 tests, checkstyle, spotless, forbidden-apis) is green. There is no JIRA issue for this yet; I will open one and add the `TIKA-XXXX` prefix to the title and commit if you would like it tracked. I can add the ASF `Generated-by:` trailer to the commit if you prefer it there as well. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
