{"record":{"id":"3f3f48eba99b3766","repo":"larksuite/cli","slug":"s-path-q-is-world-writable-mode-04o","errorCode":null,"errorMessage":"%s: path %q is world-writable (mode %04o)","messagePattern":"(.+?): path %q is world-writable \\(mode %04o\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/binding/audit_unix.go","lineNumber":44,"sourceCode":"\tif sysStat.Uid != uint32(os.Getuid()) {\n\t\treturn fmt.Errorf(\"%s: path %q is owned by uid %d, expected %d\",\n\t\t\tlabel, path, sysStat.Uid, os.Getuid())\n\t}\n\treturn nil\n}\n\n// auditFilePermissions rejects world/group-writable modes (always) and\n// world/group-readable modes (unless allowReadableByOthers is true, which\n// exec commands typically need for their usual 755 mode).\nfunc auditFilePermissions(effectivePath string, allowReadableByOthers bool, label string) error {\n\tinfo, err := vfs.Stat(effectivePath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: cannot stat %q: %w\", label, effectivePath, err)\n\t}\n\tmode := info.Mode().Perm()\n\n\tif mode&0o002 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is world-writable (mode %04o)\", label, effectivePath, mode)\n\t}\n\tif mode&0o020 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is group-writable (mode %04o)\", label, effectivePath, mode)\n\t}\n\tif allowReadableByOthers {\n\t\treturn nil\n\t}\n\tif mode&0o004 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is world-readable (mode %04o)\", label, effectivePath, mode)\n\t}\n\tif mode&0o040 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is group-readable (mode %04o)\", label, effectivePath, mode)\n\t}\n\treturn nil\n}\n","sourceCodeStart":26,"sourceCodeEnd":60,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/audit_unix.go#L26-L60","documentation":"The permission audit always rejects world-writable files (mode & 0o002 != 0). A world-writable file bound into secrets or command resolution can be modified by any user on the system, so the library refuses it unconditionally — even when AllowInsecurePath-style leniency exists for other checks, world-writable is treated as never acceptable.","triggerScenarios":"AssertSecurePath with the default security settings audits a file whose permission bits include the o+w bit (e.g. mode 0777, 0775 without group, or any mode with 0o002 set) after passing ownership checks order-independent of mode.","commonSituations":"Scripts shared via chmod 777 'to make it work'; files created by installers with umask 000; files on FAT/exFAT or SMB mounts that report 0777 for everything; samba/NFS shares exporting everything world-writable.","solutions":["chmod o-w <path> — typically chmod 755 for executables or 600 for private files, then re-run","Fix the umask used to create the file (e.g. umask 022) and recreate it","Move the file off FAT/exFAT/SMB mounts that cannot represent permission bits onto a POSIX filesystem","If the file must stay shared, place it in a directory the audit permits and have a trusted owner manage it with group-writable removed"],"exampleFix":"// before\n-rwxrwxrwx tool.sh\n// after\nchmod 755 tool.sh  # or chmod 600 for non-executable secret files\n-rwxr-xr-x tool.sh","handlingStrategy":"validation","validationCode":"func worldWritable(p string) (bool, error) {\n  fi, err := os.Stat(p)\n  if err != nil { return false, err }\n  return fi.Mode().Perm()&0o002 != 0, nil\n}\n// fix before calling: if w, _ := worldWritable(p); w { os.Chmod(p, 0o755) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never chmod 777 scripts; use 755 (exec) or 600 (private)","Set umask 022 in shell profiles and installers","Avoid storing audited files on FAT/exFAT/SMB mounts that report 0777","Audit permissions with find -perm -002 in CI before registering paths"],"tags":["security-audit","permissions","world-writable","unix"],"backgroundTag":"world-writable-file","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}