paulk-asert opened a new pull request, #2892:
URL: https://github.com/apache/groovy/pull/2892
…missions
The groovy.ast=xml debug option writes a serialized AST to <source>.xml
beside the source, through a FileWriter that creates the file at the process
umask. A source the developer had kept to themselves produced a world-readable
dump of its AST:
-rw------- Script.groovy
-rw-r--r-- Script.groovy.xml
The dump is a serialization of that source's AST, so it is no less sensitive
than the source. It is now created with the source file's own permissions, so
it exposes no more than the source already does; a world-readable source still
yields a world-readable dump, unchanged. Where there is no source file to match
— a source compiled from a string — the dump defaults to owner-only rather than
the umask; where the filesystem has no POSIX permissions, creation is left to
the writer as before.
The file is created with the permissions rather than created and then
adjusted, following the pattern used for in-place file rewrites, so its
contents are never briefly readable by anyone those permissions exclude.
XStream is an optional feature, so a testRuntimeOnly dependency is added to
let XStreamUtils be exercised; the test asserts the dump inherits a private
source's permissions and was confirmed to fail without the change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
