search

fluent / sigdump

Use signal to show stacktrace of a Ruby process without restarting it
Apache License 2.0
188 stars 27 forks source link

Avoid to write linked path #14

Open cosmo0920 opened 3 years ago

cosmo0920 commented 3 years ago

Currently, sigdump uses predictable path to write object dump. But, in some circumstances, this implementation makes a vulnerability for dangling symlink attack. And also, Kernel.open should use 0644 instead of 0666(wolrd-writable permission). This will be also vulnerability part of dangling symlink attack.

cosmo0920 commented 3 years ago

@frsyuki Could you kindly take a look if you have a time? If you don't have enough time to maintain this gem, we can handle issues/PRs on @fluent-plugins-nursery: https://github.com/fluent-plugins-nursery/contact

We think that maintainace of this gem is important for Fluentd community.