45 lines
1.9 KiB
Python
45 lines
1.9 KiB
Python
"""Protected runtime-file reader embedded in generated hook scripts."""
|
|
|
|
PROTECTED_RUNTIME_READER = r'''
|
|
MAX_PROTECTED_SECRET_BYTES = 64 * 1024
|
|
MAX_PROTECTED_CONFIG_BYTES = 512 * 1024
|
|
|
|
|
|
def read_protected_file(
|
|
file_path,
|
|
label,
|
|
max_bytes=MAX_PROTECTED_SECRET_BYTES,
|
|
require_private_permissions=True,
|
|
):
|
|
before = os.lstat(file_path)
|
|
if not stat.S_ISREG(before.st_mode) or stat.S_ISLNK(before.st_mode):
|
|
raise ValueError(label + " path is not a physical file: " + file_path)
|
|
if before.st_size > max_bytes:
|
|
raise ValueError(label + " exceeds the size limit: " + file_path)
|
|
if require_private_permissions and os.name != "nt" and before.st_mode & (stat.S_IRWXG | stat.S_IRWXO):
|
|
raise PermissionError(label + " permissions are too broad: " + file_path)
|
|
|
|
flags = os.O_RDONLY | getattr(os, "O_BINARY", 0) | getattr(os, "O_CLOEXEC", 0)
|
|
flags |= getattr(os, "O_NOFOLLOW", 0)
|
|
descriptor = os.open(file_path, flags)
|
|
try:
|
|
after = os.fstat(descriptor)
|
|
if not stat.S_ISREG(after.st_mode):
|
|
raise ValueError(label + " path is not a physical file: " + file_path)
|
|
if after.st_size > max_bytes:
|
|
raise ValueError(label + " exceeds the size limit: " + file_path)
|
|
if require_private_permissions and os.name != "nt" and after.st_mode & (stat.S_IRWXG | stat.S_IRWXO):
|
|
raise PermissionError(label + " permissions are too broad: " + file_path)
|
|
if (before.st_dev, before.st_ino) != (after.st_dev, after.st_ino):
|
|
raise OSError(label + " changed while opening: " + file_path)
|
|
with os.fdopen(descriptor, "rb") as file:
|
|
descriptor = -1
|
|
value = file.read(max_bytes + 1)
|
|
finally:
|
|
if descriptor >= 0:
|
|
os.close(descriptor)
|
|
if len(value) > max_bytes:
|
|
raise ValueError(label + " exceeds the size limit: " + file_path)
|
|
return value
|
|
'''
|