fix: address CodeQL source findings

Author: darwin67

dist/common/scripts/scylla-housekeeping

@@ -99,7 +99,7 @@ def version_compare(a, b):
 def create_uuid_file(fl):
     with open(args.uuid_file, 'w') as myfile:
         myfile.write(str(uuid.uuid1()) + "\n")
-    os.chmod(args.uuid_file, 0o644)
+    os.chmod(args.uuid_file, 0o600)
 
 
 def sanitize_version(version):

dist/common/scripts/scylla_io_setup

@@ -200,5 +200,5 @@ if __name__ == "__main__":
     cpudata = scylla_cpuinfo()
     if not is_developer_mode():
         run_iotune()
-        os.chmod(etcdir() + '/scylla.d/io_properties.yaml', 0o644)
-        os.chmod(etcdir() + '/scylla.d/io.conf', 0o644)
+        os.chmod(etcdir() + '/scylla.d/io_properties.yaml', 0o640)
+        os.chmod(etcdir() + '/scylla.d/io.conf', 0o640)

dist/common/scripts/scylla_prepare

@@ -115,7 +115,7 @@ def create_perftune_conf(cfg):
         yaml = out('/opt/scylladb/scripts/perftune.py ' + params)
         with open('/etc/scylla.d/perftune.yaml', 'w') as f:
             f.write(yaml)
-        os.chmod('/etc/scylla.d/perftune.yaml', 0o644)
+        os.chmod('/etc/scylla.d/perftune.yaml', 0o640)
         return True
     else:
         return False

dist/common/scripts/scylla_setup

@@ -353,16 +353,16 @@ if __name__ == '__main__':
                 cfg = sysconfig_parser(sysconfdir_p() / 'scylla-housekeeping')
                 repo_files = cfg.get('REPO_FILES')
                 for f in glob.glob(repo_files):
-                    os.chmod(f, 0o644)
+                    os.chmod(f, 0o640)
                 with open('/etc/scylla.d/housekeeping.cfg', 'w') as f:
                     f.write('[housekeeping]\ncheck-version: True\n')
-                os.chmod('/etc/scylla.d/housekeeping.cfg', 0o644)
+                os.chmod('/etc/scylla.d/housekeeping.cfg', 0o640)
                 systemd_unit('scylla-housekeeping-daily.timer').unmask()
                 systemd_unit('scylla-housekeeping-restart.timer').unmask()
             else:
                 with open('/etc/scylla.d/housekeeping.cfg', 'w') as f:
                     f.write('[housekeeping]\ncheck-version: False\n')
-                os.chmod('/etc/scylla.d/housekeeping.cfg', 0o644)
+                os.chmod('/etc/scylla.d/housekeeping.cfg', 0o640)
                 hk_daily = systemd_unit('scylla-housekeeping-daily.timer')
                 hk_daily.mask()
                 hk_daily.stop()

test/cql-pytest/run.py

@@ -46,7 +46,7 @@ def run_with_generated_dir(run_cmd_generator, run_dir_generator):
         (cmd, env) = run_cmd_generator(pid, dir)
         # redirect stdout and stderr to log file, as in a shell's >log 2>&1:
         log = os.path.join(dir, 'log')
-        fd = os.open(log, os.O_WRONLY | os.O_CREAT | os.O_APPEND, mode=0o666)
+        fd = os.open(log, os.O_WRONLY | os.O_CREAT | os.O_APPEND, mode=0o600)
         sys.stdout.flush()
         os.close(1)
         os.dup2(fd, 1)

test/nodetool/rest_api_mock.py

@@ -198,7 +198,7 @@ async def catching_handler(request) -> aiohttp.web.Response:
             except Exception as e:
                 tb = traceback.format_exc()
                 logger.error(f'Exception when executing {handler.__name__}: {e}\n{tb}')
-                return aiohttp.web.Response(status=500, text=str(e))
+                return aiohttp.web.Response(status=500, text="Internal server error")
         return catching_handler
 
     app.router.add_routes([

test/pylib/minio_server.py

@@ -217,6 +217,8 @@ def print_environ(self):
         msgs = []
         for key in self._get_environs():
             value = os.environ[key]
+            if key in (self.ENV_ACCESS_KEY, self.ENV_SECRET_KEY):
+                value = '<redacted>'
             msgs.append(f'export {key}={value}')
         print('\n'.join(msgs))
 

test/pylib/scylla_cluster.py

@@ -1341,7 +1341,7 @@ async def catching_handler(request) -> aiohttp.web.Response:
                 except Exception as e:
                     tb = traceback.format_exc()
                     self.logger.error(f'Exception when executing {handler.__name__}: {e}\n{tb}')
-                    return aiohttp.web.Response(status=500, text=str(e))
+                    return aiohttp.web.Response(status=500, text="Internal server error")
             return catching_handler
 
         def route_history_wrapper(blockable = False)-> Callable:

utils/managed_bytes.hh

@@ -245,16 +245,11 @@ public:
             auto first = new (p) multi_chunk_blob_storage(&_u.multi_chunk_ref, size, now);
             auto last = first;
             size -= now;
-            try {
-                while (size) {
-                    auto now = std::min(size_t(size), maxseg);
-                    void* p = alctr.alloc<multi_chunk_blob_storage>(sizeof(multi_chunk_blob_storage) + now);
-                    last = new (p) multi_chunk_blob_storage(&last->next, 0, now);
-                    size -= now;
-                }
-            } catch (...) {
-                free_chain(first);
-                throw;
+            while (size) {
+                auto now = std::min(size_t(size), maxseg);
+                void* p = alctr.alloc<multi_chunk_blob_storage>(sizeof(multi_chunk_blob_storage) + now);
+                last = new (p) multi_chunk_blob_storage(&last->next, 0, now);
+                size -= now;
             }
           }
         }