Repository navigation
fix: keep socket and transform cache directories private to the user - #43691
Yury Semikhatsky (yury-s) wants to merge 1 commit into
Conversation
On a shared /tmp, another user could create the predictable socket or transform cache directory first, then replace sockets or plant cached code. Create these directories with mode 0700 and refuse ones that the current user does not own. The transform cache falls back to no disk cache in that case.
Test results for "MCP"5189 passed, 614 skipped Merge workflow run. |
Test results for "tests 1"1 failed 23574 passed, 708 skipped Merge workflow run. |
🟡 Uncertain whether this PR caused the failureHi, I'm the Playwright bot. I checked the latest CI report, the diff, and refreshed test history for DetailsThere is one failing test. I found no direct link to the PR's changes, but no matching historical failure that would establish a pre-existing flake either. Uncertain
A repeated comparison of this test on the PR head and its base, using the same macOS runner setup, is needed to distinguish a PR effect from an unconfirmed timing failure. Triaged by the Playwright bot - agent run |
Pavel Feldman (pavelfeldman)
left a comment
There was a problem hiding this comment.
I would make this opt-in with a documented environment variable pointing to the location.
Summary
browser.bind) and the transform cache directory with mode 0700, and refuse an existing one that the current user does not own. On a shared/tmp, another user could create these predictable directories first.Fixes #43698