Skip to content

Conversation

@tueda
Copy link
Owner

@tueda tueda commented Dec 3, 2025

No description provided.

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR removes the function keyword from all bash function definitions in scripts/make-release.sh, aligning with POSIX-compatible bash syntax and the project's existing convention (as demonstrated in scripts/update-gitignore.sh). The Script Core Version is also updated to reflect the current date.

Key Changes:

  • Removed function keyword from 13 function definitions, converting them to name() { syntax
  • Added missing parentheses to abort function definition (was function abort {, now abort() {)
  • Updated Script Core Version from 2025.08.24 to 2025.12.03
Comments suppressed due to low confidence (1)

scripts/make-release.sh:118

  • sed_i creates a predictable temporary file (local temp="$file.$$.$RANDOM") in the target file's directory and writes to it. An attacker with write access to that directory can pre-create a symlink with that name to another path, causing sed/mv to overwrite arbitrary files. Use mktemp to create a securely randomized temp file and ensure the temp file is created with safe permissions, e.g.,
local temp
temp=$(mktemp "${file}.XXXXXX") || abort "mktemp failed"
sed "$@" >"$temp" && mv -f "$temp" "$file"
  local temp="$file.$$.$RANDOM"
  if sed "$@" >"$temp"; then
    mv "$temp" "$file"

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@tueda
Copy link
Owner Author

tueda commented Dec 3, 2025

Copilot's suggestion for sed_i (using mktemp) does not preserve the file permissions.

@tueda tueda merged commit 13187b5 into master Dec 3, 2025
22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants