core-lead/molecule-core
1
0
Fork 0
forked from molecule-ai/molecule-core
Code Pull Requests Activity

Merge pull request #297 from Molecule-AI/fix/cdp-plist-chmod-600

Browse Source 
fix(security): chmod 600 macOS launchd plist (#296)
This commit is contained in:
Hongming Wang 2026-04-15 18:20:55 -07:00 committed by GitHub
commit 1453e57fb7
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
plugins/browser-automation/host-bridge/install-host-bridge.sh
View File

@ -68,6 +68,11 @@ install_macos() {
<key>StandardErrorPath</key><string>${HOME}/.molecule-cdp-proxy.log</string>
</dict></plist>
EOF
# #296: the plist contains the CDP_PROXY_TOKEN in plaintext. Default
# umask leaves it world-readable (~0644) which leaks the token to any
# local user on a multi-account macOS host. Lock to owner-only. launchctl
# loads user agents as the owning UID so 0600 is safe.
chmod 600 "$plist"
launchctl bootout "gui/$(id -u)/${LABEL}" 2>/dev/null || true
launchctl bootstrap "gui/$(id -u)" "$plist"
launchctl kickstart -k "gui/$(id -u)/${LABEL}"