gpt4free

公开

关注 0 Fork 0 Star 1

返回提交历史

XFEstudio/gpt4free

fix(security): enforce restricted permissions on cookie and private key storage

e260e2bd

Anand Mall <anand@example.com>

提交于 2026-09-07 12:01

父提交 a51fc0b

代码差异

3 个文件 +22 -1

Modified g4f/cookies.py +12 -1

@@ -222,7 +222,18 @@ def set_cookies_dir(dir_path: str) -> None:

222 222

223 223

224 224 def get_cookies_dir() -> str:

225 return CookiesConfig.cookies_dir

225 path = CookiesConfig.cookies_dir

226 try:

227 if not os.path.exists(path):

228 os.makedirs(path, mode=0o700, exist_ok=True)

229 elif hasattr(os, "chmod") and os.name != "nt":

230 try:

231 os.chmod(path, 0o700)

232 except OSError:

233 pass

234 except OSError:

235 pass

236 return path

226 237

227 238

228 239 def _get_domain(entry: dict) -> Optional[str]:

Modified g4f/gui/server/backend_api.py +5 -0

@@ -1008,6 +1008,11 @@ class Backend_Api(Api):

1008 1008 if not target_path.startswith(cookies_dir):

1009 1009 return "Forbidden file path", 403

1010 1010 file.save(target_path)

1011 if hasattr(os, "chmod") and os.name != "nt":

1012 try:

1013 os.chmod(target_path, 0o600)

1014 except OSError:

1015 pass

1011 1016 return "File saved", 200

1012 1017 return "Not supported file", 400

1013 1018

Modified g4f/gui/server/crypto.py +5 -0

@@ -63,6 +63,11 @@ def create_or_read_keys() -> tuple[RSAPrivateKey, RSAPublicKey]:

63 63 # Write the private key PEM to a file

64 64 with open(private_key_file, "wb") as f:

65 65 f.write(private_key_pem)

66 if hasattr(os, "chmod") and os.name != "nt":

67 try:

68 os.chmod(private_key_file, 0o600)

69 except OSError:

70 pass

66 71

67 72 # Write the public key PEM to a file

68 73 with open(public_key_file, "wb") as f: