mirror of
https://github.com/vlang/v.git
synced 2025-09-09 15:27:05 -04:00
os: format readme, fix markdown inside html (#21286)
This commit is contained in:
parent
183c199021
commit
e676245903
@ -4,22 +4,20 @@
|
||||
command line arguments, reading/writing files, listing folders,
|
||||
handling processes etc.
|
||||
|
||||
* * *
|
||||
|
||||
---
|
||||
|
||||
### Security advice related to TOCTOU attacks
|
||||
|
||||
A few `os` module functions can lead to the <b>TOCTOU</b> vulnerability if used incorrectly.
|
||||
<b>TOCTOU</b> (Time-of-Check-to-Time-of-Use problem) can occur when a file, folder or similar
|
||||
A few `os` module functions can lead to the **TOCTOU** vulnerability if used incorrectly.
|
||||
**TOCTOU** (Time-of-Check-to-Time-of-Use problem) can occur when a file, folder or similar
|
||||
is checked for certain specifications (e.g. read, write permissions) and a change is made
|
||||
afterwards.
|
||||
In the time between the initial check and the edit, an attacker can then cause damage.
|
||||
The following example shows an attack strategy on the left and an improved variant on the right
|
||||
so that <b>TOCTOU</b> is no longer possible.
|
||||
so that **TOCTOU** is no longer possible.
|
||||
|
||||
|
||||
<b>Example</b>
|
||||
<i>Hint</i>: `os.create()` opens a file in write-only mode
|
||||
**Example** <br>
|
||||
*Hint*: `os.create()` opens a file in write-only mode
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
@ -39,6 +37,7 @@ if os.is_writable("file") {
|
||||
f.close()
|
||||
}
|
||||
```
|
||||
|
||||
</td>
|
||||
<td>
|
||||
|
||||
@ -52,14 +51,15 @@ mut f := os.create('path/to/file') or {
|
||||
|
||||
f.close()
|
||||
```
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<b> Proven affected functions </b></br>
|
||||
**Proven affected functions** <br>
|
||||
The following functions should be used with care and only when used correctly.
|
||||
|
||||
* os.is_readable()
|
||||
* os.is_writable()
|
||||
* os.is_executable()
|
||||
* os.is_link()
|
||||
- os.is_readable()
|
||||
- os.is_writable()
|
||||
- os.is_executable()
|
||||
- os.is_link()
|
||||
|
Loading…
x
Reference in New Issue
Block a user