fix(security): skip POSIX tmp-dir permission check on Windows - #191
Open
Snownamida wants to merge 1 commit into
Open
fix(security): skip POSIX tmp-dir permission check on Windows#191Snownamida wants to merge 1 commit into
Snownamida wants to merge 1 commit into
Conversation
nsIFile.permissions reports permissive pseudo-modes on Windows and the setter is a no-op, so the group/world hardening check always throws and the MCP server never starts (connection.json is never written). Skip the fatal check on WINNT. The connection file remains protected by O_EXCL creation, localhost-only binding, and the per-session bearer token. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On Windows the MCP server never starts:
writeConnectionInfothrows "thunderbird-mcp tmp directory has group/world permissions — refusing to write connection info", soconnection.jsonis never written and the bridge cannot discover the server.Root cause
The POSIX hardening check in
writeConnectionInforeadsnsIFile.permissionson the existing<TmpD>/thunderbird-mcpdirectory:nsIFile.permissionsreports permissive pseudo-modes (group/world bits set) instead of0, contradicting the in-code comment that "permissions is 0 on platforms that don't expose POSIX modes (Windows ACLs)".permissionssetter (= 0o700) is a no-op on Windows, so the re-check always still sees group/world bits and the fatal throw fires on every start.Fix
Skip the fatal check on Windows (
Services.appinfo.OS !== "WINNT"). The best-effort chmod is retained for POSIX platforms. The connection file remains protected by O_EXCL creation (symlink/overwrite defense), localhost-only binding by default, and the per-session bearer token.Reproduction
Failed to start MCP server: Error: thunderbird-mcp tmp directory has group/world permissions — refusing to write connection info<TmpD>\thunderbird-mcpdirectory exists butconnection.jsonis never written🤖 Generated with Claude Code