Repository navigation
Restrict artifact temp directory permissions on Unix - #15729
Merged
Jakub Jareš (nohwnd) merged 5 commits intoMay 6, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Restricts permissions on the artifact-processing temp directory on Unix so artifacts are only accessible by the creating user.
Changes:
- Create the correlationId parent artifact directory before writing artifacts.
- Add Unix-only permission hardening (0700) for that directory via
chmod(no-op on Windows / .NET Framework).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Jakub Jareš (nohwnd)
force-pushed
the
secure-artifact-temp-dir
branch
from
April 28, 2026 14:50
4fc1c73 to
942ed8a
Compare
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ectory Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Jan Krivanek (JanKrivanek)
approved these changes
May 5, 2026
This was referenced Jul 14, 2026
github-actions Bot
pushed a commit
to Nimblesite/SharpLsp
that referenced
this pull request
Jul 14, 2026
Updated [Microsoft.NET.Test.Sdk](https://github.com/microsoft/vstest) from 18.7.0 to 18.8.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.NET.Test.Sdk's releases](https://github.com/microsoft/vstest/releases)._ ## 18.8.0 ## What's Changed * Migrate from Newtonsoft.Json to System.Text.Json / Jsonite (merge to main) by @nohwnd in microsoft/vstest#15687 - For more detail refer to https://devblogs.microsoft.com/dotnet/vs-test-is-removing-its-newtonsoft-json-dependency/ * Create source-only filter package by @Youssef1313 in microsoft/vstest#15638 - Package release is pending. * Add ARM64 msdia140.dll support to test platform packages by @nohwnd in microsoft/vstest#15692 * Fix mutex cleanup crash on macOS/Linux by @nohwnd in microsoft/vstest#15684 * Restrict artifact temp directory permissions on Unix by @nohwnd in microsoft/vstest#15729 * Add support for filtering uncategorized tests with TestCategory=None by @Evangelink in microsoft/vstest#15727 * Fix SCI binding failure in DTA hosts (main) by @nohwnd in microsoft/vstest#15724 * Fix HTML logger parallel file collision by @nohwnd in microsoft/vstest#15435 * Improve error message when testhost cannot be found by @nohwnd in microsoft/vstest#16053 * Fix HTML logger exception on invalid XML chars in test display names by @nohwnd in microsoft/vstest#16051 **Full Changelog**: microsoft/vstest@v18.7.0...v18.8.0 Commits viewable in [compare view](microsoft/vstest@v18.7.0...v18.8.0). </details> Updated [Serilog](https://github.com/serilog/serilog) from 4.3.1 to 4.4.0. <details> <summary>Release notes</summary> _Sourced from [Serilog's releases](https://github.com/serilog/serilog/releases)._ ## 4.4.0 ## What's Changed * Emit SelfLog warning when extra arguments are provided by @matantsach in serilog/serilog#2222 * dont WriteQuotedJsonString for null by @SimonCropp in serilog/serilog#2216 * Pin System.Security.Cryptography.Xml to 8.0.3 in tests by @ArieGato in serilog/serilog#2232 * Route optional interfaces through OptionalInterfaceForwardingSink for restricted sinks by @ArieGato in serilog/serilog#2234 * `SelfMetrics` by @nblumhardt in serilog/serilog#2237 ## New Contributors * @matantsach made their first contribution in serilog/serilog#2222 * @ArieGato made their first contribution in serilog/serilog#2232 **Full Changelog**: serilog/serilog@v4.3.1...v4.4.0 Commits viewable in [compare view](serilog/serilog@v4.3.1...v4.4.0). </details> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Nov 11, 2026
Open
Merged
Open
Merged
Merged
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Set 0700 on the artifact processing directory on non-Windows so it is only accessible by the creating user.
Implicitly tested by
DotnetSDKSimulation_PostProcessingwhich does a full collect + post-process round-trip through the real temp path.