fix: make Cursor hooks fail closed

elydora/plugins/runtime_reader_template.py

@@ -0,0 +1,44 @@
+"""Protected runtime-file reader embedded in generated hook scripts."""
+
+PROTECTED_RUNTIME_READER = r'''
+MAX_PROTECTED_SECRET_BYTES = 64 * 1024
+MAX_PROTECTED_CONFIG_BYTES = 512 * 1024
+
+
+def read_protected_file(
+    file_path,
+    label,
+    max_bytes=MAX_PROTECTED_SECRET_BYTES,
+    require_private_permissions=True,
+):
+    before = os.lstat(file_path)
+    if not stat.S_ISREG(before.st_mode) or stat.S_ISLNK(before.st_mode):
+        raise ValueError(label + " path is not a physical file: " + file_path)
+    if before.st_size > max_bytes:
+        raise ValueError(label + " exceeds the size limit: " + file_path)
+    if require_private_permissions and os.name != "nt" and before.st_mode & (stat.S_IRWXG | stat.S_IRWXO):
+        raise PermissionError(label + " permissions are too broad: " + file_path)
+
+    flags = os.O_RDONLY | getattr(os, "O_BINARY", 0) | getattr(os, "O_CLOEXEC", 0)
+    flags |= getattr(os, "O_NOFOLLOW", 0)
+    descriptor = os.open(file_path, flags)
+    try:
+        after = os.fstat(descriptor)
+        if not stat.S_ISREG(after.st_mode):
+            raise ValueError(label + " path is not a physical file: " + file_path)
+        if after.st_size > max_bytes:
+            raise ValueError(label + " exceeds the size limit: " + file_path)
+        if require_private_permissions and os.name != "nt" and after.st_mode & (stat.S_IRWXG | stat.S_IRWXO):
+            raise PermissionError(label + " permissions are too broad: " + file_path)
+        if (before.st_dev, before.st_ino) != (after.st_dev, after.st_ino):
+            raise OSError(label + " changed while opening: " + file_path)
+        with os.fdopen(descriptor, "rb") as file:
+            descriptor = -1
+            value = file.read(max_bytes + 1)
+    finally:
+        if descriptor >= 0:
+            os.close(descriptor)
+    if len(value) > max_bytes:
+        raise ValueError(label + " exceeds the size limit: " + file_path)
+    return value
+'''