secret_input.go RawHistoryFolder

1package cli
2
3import (
4	"fmt"
5	"io"
6	"os"
7	"strings"
8
9	"golang.org/x/sys/unix"
10)
11
12func readProtectedSecretFile(path string) (string, error) {
13	fd, err := unix.Open(path, unix.O_RDONLY|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0)
14	if err != nil {
15		return "", fmt.Errorf("open secret file %s: %w", path, err)
16	}
17	if fd < 0 {
18		return "", fmt.Errorf("open secret file %s: invalid file descriptor %d", path, fd)
19	}
20	//nolint:gosec // G115: fd is validated non-negative and originates from unix.Open.
21	file := os.NewFile(uintptr(fd), path)
22	if file == nil {
23		_ = unix.Close(fd)
24		return "", fmt.Errorf("open secret file %s: invalid file descriptor", path)
25	}
26	defer file.Close()
27
28	info, err := file.Stat()
29	if err != nil {
30		return "", fmt.Errorf("stat secret file %s: %w", path, err)
31	}
32	if !info.Mode().IsRegular() {
33		return "", fmt.Errorf("%s is not a regular file", path)
34	}
35	if info.Mode().Perm()&0o077 != 0 {
36		return "", fmt.Errorf("%s must not be accessible by group or others (use chmod 600)", path)
37	}
38	data, err := io.ReadAll(file)
39	if err != nil {
40		return "", fmt.Errorf("read secret file %s: %w", path, err)
41	}
42	value := strings.TrimSpace(string(data))
43	if value == "" {
44		return "", fmt.Errorf("%s is empty", path)
45	}
46	return value, nil
47}