Rocket.Chat.Electron icon indicating copy to clipboard operation
Rocket.Chat.Electron copied to clipboard

fix: ensure supportedVersions cache is created with secure permissions (0600)

Open Nitinref opened this issue 3 weeks ago β€’ 3 comments

This PR fixes incorrect permission mode for the supportedVersions ElectronStore cache file.

The file was created with default permissions (~644), which caused permission errors when reading the cache in some environments.
This fix sets fileMode: 0o600 so the cache is readable and writable only by the current user.

Tested on Windows and WSL β€” the cache file is now created with 600 permissions.

Screenshot:

Closes #3147

Summary by CodeRabbit

  • Bug Fixes

    • Improved error messaging and diagnostic logging to help users identify and troubleshoot issues more effectively.
  • Chores

    • Internal configuration optimizations and refined error handling mechanisms for enhanced security and reliability.

✏️ Tip: You can customize this high-level summary in your review settings.

Nitinref avatar Dec 01 '25 05:12 Nitinref

CLA assistant check
All committers have signed the CLA.

CLAassistant avatar Dec 01 '25 05:12 CLAassistant

Walkthrough

Modifies ElectronStore initialization to set file permissions to 0o600 (read/write only for owner) instead of the default permissive mode, addressing a security issue. Also restructures error logging in the request handler with explicit branches for different error types.

Changes

Cohort / File(s) Summary
ElectronStore Configuration & Error Logging
src/servers/supportedVersions/main.ts
Introduces MyStoreOptions interface and sets fileMode: 0o600 on ElectronStore initialization for restrictive file permissions. Refactors logRequestError with explicit branching: logs error.message for AxiosErrors without response, and updates non-AxiosError logging pattern with literal error description string.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

  • Single-file change with straightforward configuration and logging updates
  • No complex logic, control flow changes, or multi-component interactions
  • Security fix follows standard permission-setting pattern
  • Error logging improvements are incremental and isolated

Poem

🐰 A rabbit hops through the config, so fine,
Setting permissions to 0o600 in a line,
No more world-writable woes,
Secure file modes the whole tunnel knows! πŸ”βœ¨

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Out of Scope Changes check ⚠️ Warning The PR includes modifications to error handling in logRequestError function that are unrelated to the permission fix objective from issue #3147. Remove the error handling changes to logRequestError; keep only the supportedVersions cache permission fix required to resolve issue #3147.
βœ… Passed checks (4 passed)
Check name Status Explanation
Description Check βœ… Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check βœ… Passed The title accurately describes the main change: fixing the supportedVersions cache file permissions to use secure mode (0600).
Linked Issues check βœ… Passed The PR changes set fileMode to 0o600 for supportedVersions ElectronStore, directly addressing issue #3147's requirement for secure file permissions.
Docstring Coverage βœ… Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing touches
  • [ ] πŸ“ Generate docstrings
πŸ§ͺ Generate unit tests (beta)
  • [ ] Create PR with unit tests
  • [ ] Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❀️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

coderabbitai[bot] avatar Dec 01 '25 05:12 coderabbitai[bot]

I have created a pull request to fix this issue: #3148. The PR adds secure file permissions (0600) to the supportedVersions cache so it is only readable/writable by the current user.
Tested on Windows and WSL. Please review when possible. πŸ™‚

Nitinref avatar Dec 01 '25 05:12 Nitinref