From 514bc8ceae2d12109bf8dd2762328b1e59674cd2 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 10 Oct 2026 23:29:05 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?=
 =?UTF-8?q?Fix=20overly=20permissive=20permissions=20for=20saved=20request?=
 =?UTF-8?q?s=20directory?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🚨 Severity: MEDIUM
💡 Vulnerability: The directory used for saved requests was created with `0o755` permissions, allowing any local user to traverse the directory and list saved files.
🎯 Impact: While files themselves were `0o600`, knowing the presence/filenames of saved HTTP requests constitutes a minor information leak on multi-user systems.
🔧 Fix: Updated `os.MkdirAll` to use `0o700` instead, ensuring only the owner has access to the directory contents.
✅ Verification: Ensure the tests pass by running `make check`.

Co-authored-by: tejjasdev <213147578+tejjasdev@users.noreply.github.com>
---
 .jules/sentinel.md        | 4 ++++
 internal/export/export.go | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..5318123
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2026-10-10 - Update SaveRequest Directory Permissions
+**Vulnerability:** Saved request directories had overly permissive permissions (`0o755`), potentially allowing local users to view saved files including sensitive payloads/headers.
+**Learning:** The application captures arbitrary incoming HTTP requests and allows users to export/save them locally. While `SaveRequest` attempts to redact sensitive headers, other non-redacted data might be sensitive. The directory `SaveDir` where requests are saved was created with `0o755`.
+**Prevention:** Create directories containing sensitive user-data/traffic with `0o700` permissions so only the owner has access.
diff --git a/internal/export/export.go b/internal/export/export.go
index 7b0e25b..95e4043 100644
--- a/internal/export/export.go
+++ b/internal/export/export.go
@@ -89,7 +89,7 @@ func SaveRequest(dir string, ev events.Event, redact bool) (string, error) {
 	if dir == "" {
 		dir = "."
 	}
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := os.MkdirAll(dir, 0o700); err != nil {
 		return "", err
 	}
 	method := cleanName(ev.Request.Method)