Harden checksum writes against symlink attacks

writeChecksum used os.WriteFile, which follows symlinks. A local attacker who could create a symlink in .gogo/checksum/ before the user ran a task could redirect the write to an arbitrary file. Remove any pre-existing entry first (Remove does not follow symlinks) and then create the file with O_CREATE|O_EXCL so a racing symlink replacement fails the open.

Author: dgageot

taskfile/checksum.go

@@ -3,6 +3,7 @@ package taskfile
 import (
 	"crypto/sha256"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"io/fs"
 	"os"
@@ -150,13 +151,31 @@ func readStoredChecksum(fileDir, taskName string) string {
 	return string(data)
 }
 
-// writeChecksum stores the checksum for a task.
+// writeChecksum stores the checksum for a task. The write is hardened
+// against local symlink attacks: we remove any pre-existing entry (without
+// following symlinks) and then re-create the file with O_CREATE|O_EXCL so
+// a pre-placed symlink in .gogo/checksum/ can't redirect the write
+// elsewhere on disk — if an attacker wins the race and recreates a
+// symlink between the Remove and the OpenFile, the OpenFile call fails.
 func writeChecksum(fileDir, taskName, checksum string) error {
 	p := checksumPath(fileDir, taskName)
 	if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
 		return err
 	}
-	return os.WriteFile(p, []byte(checksum), 0o644)
+	// os.Remove does not follow symlinks, so we only ever delete the entry
+	// itself, never its target.
+	if err := os.Remove(p); err != nil && !errors.Is(err, os.ErrNotExist) {
+		return err
+	}
+	f, err := os.OpenFile(p, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o644)
+	if err != nil {
+		return err
+	}
+	if _, err := f.WriteString(checksum); err != nil {
+		_ = f.Close()
+		return err
+	}
+	return f.Close()
 }
 
 // outputsNewerThanSources checks if all generated files exist and are newer

taskfile/checksum_test.go

@@ -169,6 +169,35 @@ func TestChecksumPathNoCollision(t *testing.T) {
 	assert.Equal(t, "underscore", readStoredChecksum(dir, "a_b"))
 }
 
+func TestWriteChecksumDoesNotFollowSymlink(t *testing.T) {
+	// A pre-placed symlink in .gogo/checksum/ must not redirect the write
+	// to another file on disk: an attacker with write access to .gogo/
+	// could otherwise have gogo overwrite arbitrary files when the user
+	// next runs a task.
+	dir := t.TempDir()
+	target := filepath.Join(dir, "target.txt")
+	require.NoError(t, os.WriteFile(target, []byte("original"), 0o644))
+
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, ".gogo", "checksum"), 0o755))
+	link := filepath.Join(dir, ".gogo", "checksum", "build")
+	require.NoError(t, os.Symlink(target, link))
+
+	require.NoError(t, writeChecksum(dir, "build", "new-checksum"))
+
+	// The symlink target must remain untouched.
+	data, err := os.ReadFile(target)
+	require.NoError(t, err)
+	assert.Equal(t, "original", string(data), "symlink target must not be overwritten")
+
+	// And the cache file must contain the new value.
+	assert.Equal(t, "new-checksum", readStoredChecksum(dir, "build"))
+
+	// The cache entry must be a regular file, not a symlink anymore.
+	info, err := os.Lstat(link)
+	require.NoError(t, err)
+	assert.Zero(t, info.Mode()&os.ModeSymlink, "checksum entry must not be a symlink")
+}
+
 func TestOutputsNewerThanSources(t *testing.T) {
 	dir := t.TempDir()
 	src := filepath.Join(dir, "main.go")