sec

nitrictech · Jun 3, 2024 · a4d6f54 · a4d6f54
1 parent 3b3e1cc
commit a4d6f54
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 4 deletions.
diff --git a/cloud/common/deploy/image/inline.go b/cloud/common/deploy/image/inline.go
@@ -52,7 +52,7 @@ func BuildWrappedImage(args *BuildWrappedImageArgs) (string, error) {
 	}
 
 	buildContext := fmt.Sprintf("%s/build-%s", os.TempDir(), args.ServiceName)
-	err = os.MkdirAll(buildContext, os.ModePerm)
+	err = os.MkdirAll(buildContext, 0o750)
 	if err != nil {
 		return "", err
 	}

diff --git a/cloud/common/deploy/provider/terraform.go b/cloud/common/deploy/provider/terraform.go
@@ -131,7 +131,7 @@ func createTerraformStackForNitricProvider(req *deploymentspb.DeploymentUpReques
 	// modules dir
 	modulesDir := filepath.Join(parentDir)
 
-	err = os.MkdirAll(modulesDir, os.ModePerm)
+	err = os.MkdirAll(modulesDir, 0o750)
 	if err != nil {
 		return err
 	}
@@ -151,7 +151,8 @@ func createTerraformStackForNitricProvider(req *deploymentspb.DeploymentUpReques
 			}
 			defer data.Close()
 
-			out, err := os.Create(filepath.Join(path))
+			//#nosec G304 -- path unpacking known modules embedded fs
+			out, err := os.Create(path)
 			if err != nil {
 				return err
 			}
@@ -161,7 +162,7 @@ func createTerraformStackForNitricProvider(req *deploymentspb.DeploymentUpReques
 			return err
 		}
 
-		return os.MkdirAll(filepath.Join(path), 0o755)
+		return os.MkdirAll(path, 0o750)
 	})
 	if err != nil {
 		return err