Skip to content

Commit

Permalink
Fixes TOCTOU issue by removing the access() check and replacing it …
Browse files Browse the repository at this point in the history
…with a handled error for `fopen()`
  • Loading branch information
xWyatt committed Nov 30, 2021
1 parent 541c8b6 commit ad60c8f
Showing 1 changed file with 6 additions and 8 deletions.
14 changes: 6 additions & 8 deletions src/read_input.c
Original file line number Diff line number Diff line change
Expand Up @@ -369,11 +369,12 @@ int validateArguments(int argc, char** argv) {
return 0;
}

// Verify file exists and we can read it
if (access(nextArg, R_OK) != -1) {

// Open File
FILE *basicAuthFile = (FILE*) fopen(nextArg, "r");
// Open File
FILE *basicAuthFile = (FILE*) fopen(nextArg, "r");
if (basicAuthFile == NULL) {
printf("Cannot read from file '%s' to retrieve Basic Auth credentials. Verify the file exists and has read permission.\n\n%s", nextArg, helpMessage);
return 0;
} else {

// Read line into buffer
char* buffer = NULL;
Expand Down Expand Up @@ -415,9 +416,6 @@ int validateArguments(int argc, char** argv) {
printf("No data in file '%s'. Verify the file has only one line and contains only '<username>:<password>'\n\n%s", nextArg, helpMessage);
return 0;
}
} else {
printf("Cannot read from file '%s' to retrieve Basic Auth credentials. Verify the file exists and has read permission.\n\n%s", nextArg, helpMessage);
return 0;
}
}

Expand Down

0 comments on commit ad60c8f

Please sign in to comment.