docs: mention umask need when curl creates files

for cookies, alt-svc and HSTS, command line and library

Closes #19396

diff --git a/.github/scripts/pyspelling.words b/.github/scripts/pyspelling.words
index a5c28091301f11b5400392db40cc18a65ed7024b..f64025b2adbc650053b60364acc0853fa755fbe7 100644 (file)
--- a/.github/scripts/pyspelling.words
+++ b/.github/scripts/pyspelling.words
@@ -889,6 +889,7 @@ UI
 UID
 UIDL
 Ultrix
+umask
 Unary
 unassign
 UNC

diff --git a/docs/cmdline-opts/alt-svc.md b/docs/cmdline-opts/alt-svc.md
index 257f4d5b9cb7fabc51e6400fa12c5c974db4df0d..a3b17d04f182a33e3515d60e0ab4d91d2db66104 100644 (file)
--- a/docs/cmdline-opts/alt-svc.md
+++ b/docs/cmdline-opts/alt-svc.md
@@ -24,5 +24,8 @@ filename again if it has been modified.
 Specify a "" filename (zero length) to avoid loading/saving and make curl just
 handle the cache in memory.
 
+You may want to restrict your umask to prevent other users on the same system
+to access the created file.
+
 If this option is used several times, curl loads contents from all the
 files but the last one is used for saving.

diff --git a/docs/cmdline-opts/cookie-jar.md b/docs/cmdline-opts/cookie-jar.md
index 103144acc31436b187be4c8a17cd98042becdb79..de09fd5274d4910a277b5c229f090c03bccd56a5 100644 (file)
--- a/docs/cmdline-opts/cookie-jar.md
+++ b/docs/cmdline-opts/cookie-jar.md
@@ -37,3 +37,6 @@ If the cookie jar cannot be created or written to, the whole curl operation
 does not fail or even report an error clearly. Using --verbose gets a warning
 displayed, but that is the only visible feedback you get about this possibly
 lethal situation.
+
+You may want to restrict your umask to prevent other users on the same system
+to access the created file.

diff --git a/docs/cmdline-opts/hsts.md b/docs/cmdline-opts/hsts.md
index ca6b07e66d6630e5e1f1387bfded15c4afff4d68..f58566e95dfbde4d32cff13bdb37abc28152f4d0 100644 (file)
--- a/docs/cmdline-opts/hsts.md
+++ b/docs/cmdline-opts/hsts.md
@@ -28,5 +28,8 @@ performed.
 Specify a "" filename (zero length) to avoid loading/saving and make curl just
 handle HSTS in memory.
 
+You may want to restrict your umask to prevent other users on the same system
+to access the created file.
+
 If this option is used several times, curl loads contents from all the
 files but the last one is used for saving.

diff --git a/docs/libcurl/opts/CURLOPT_ALTSVC.md b/docs/libcurl/opts/CURLOPT_ALTSVC.md
index b74565790cddef66b1a136b48cf031291fd2d04e..0b2a9cad723217b34357842a243fb0156109a01c 100644 (file)
--- a/docs/libcurl/opts/CURLOPT_ALTSVC.md
+++ b/docs/libcurl/opts/CURLOPT_ALTSVC.md
@@ -47,6 +47,10 @@ libcurl cannot fully protect against attacks where an attacker has write
 access to the same directory where it is directed to save files. This is
 particularly sensitive if you save files using elevated privileges.
 
+libcurl creates the file to store the alt-svc cache in using default file
+permissions, meaning that on *nix systems you may need to restrict your umask
+to prevent other users on the same system to access the file.
+
 # DEFAULT
 
 NULL. The alt-svc cache is not read nor written to file.

diff --git a/docs/libcurl/opts/CURLOPT_COOKIEJAR.md b/docs/libcurl/opts/CURLOPT_COOKIEJAR.md
index 646972792efe0e094a85fe7e0198ccda8d753ffd..01cf9c01c6fb3d41183f1cd40b99339c247b7b22 100644 (file)
--- a/docs/libcurl/opts/CURLOPT_COOKIEJAR.md
+++ b/docs/libcurl/opts/CURLOPT_COOKIEJAR.md
@@ -58,6 +58,10 @@ libcurl cannot fully protect against attacks where an attacker has write
 access to the same directory where it is directed to save files. This is
 particularly sensitive if you save files using elevated privileges.
 
+libcurl creates the file to store cookies using default file permissions,
+meaning that on *nix systems you may need to restrict your umask to prevent
+other users on the same system to access the file.
+
 # DEFAULT
 
 NULL

diff --git a/docs/libcurl/opts/CURLOPT_HSTS.md b/docs/libcurl/opts/CURLOPT_HSTS.md
index 79665d0a5c1e729d2ec7928c206aff25d3ef336e..667d159726403d4b57874ef90121d7ad48cbc8f3 100644 (file)
--- a/docs/libcurl/opts/CURLOPT_HSTS.md
+++ b/docs/libcurl/opts/CURLOPT_HSTS.md
@@ -67,6 +67,10 @@ libcurl cannot fully protect against attacks where an attacker has write
 access to the same directory where it is directed to save files. This is
 particularly sensitive if you save files using elevated privileges.
 
+libcurl creates the file to store HSTS data in using default file permissions,
+meaning that on *nix systems you may need to restrict your umask to prevent
+other users on the same system to access the file.
+
 # %PROTOCOLS%
 
 # EXAMPLE