Repository navigation
[Bug]: Socket and transform cache directories in a shared /tmp are not private to the user #43698
Description
Version
main (1.65.0-next)
Steps to reproduce
On Linux with a shared /tmp and two users, A and B:
- As B, before A runs anything:
mkdir -m 777 /tmp/playwright-transform-cache-<uid of A>andmkdir -m 777 /tmp/pw-<first 8 hex chars of sha1($USER of A)>. - As A, run
npx playwright test, and start a CLI session (npx playwright cli open). - As B, list both directories.
Expected behavior
Playwright creates these directories with mode 0700 and does not use a directory that another user owns.
Actual behavior
A uses B's directories:
- The transform cache (
packages/playwright/src/transform/compilationCache.ts) reads and writes transpiled test code there. B can read it, and can put entries there that A's runner executes. The entry header only detects partial writes. - The CLI daemon, dashboard and
browser.bindsockets (makeSocketPathinpackages/utils/fileUtils.ts) are created there, so B can replace them.
Without step 1, both directories are created with mode 0755, so other users can read the cached test code.
macOS and Windows use a per-user temp directory and are not affected.
Activity
github-actions commentedon Oct 29, 2026
github-actions commentedon Oct 29, 2026
Hi, I'm the Playwright bot and I reproduced this on Linux.
Reproduced on
1.65.0-next(ac44835d064d1e824ed1ba8b9f544f3493ec3dbe). The default cache and socket directories accept directories owned by another user. The proposed fix creates or restricts these directories to mode0700and rejects foreign-owned directories and symlinks before use, including cache hits.Verification
On main, the cache and CLI socket-directory tests create directories with mode
0755. A separate probe using world-writable default directories owned by UID 65534 confirms that UID 1001 accepts both a benign cache entry and a Chromiumbrowser.bind()socket directory. The cache entry is inspected, not executed.The fix rejects both foreign-owned directories and a symlinked cache root containing a cache hit. The cache and loader suites pass all 96 tests; the CLI session suite passes all 75 tests across Chromium, Firefox, and WebKit. Build and
npm run flintpass. All checks were run on Linux.Draft fix: #43751
Triaged on Linux by the Playwright bot - agent run
yury-s commentedon Oct 29, 2026
It has been fixed by #43732 and #43733