jif 929e2b9c1d Harden MCP OAuth fallback credential writes (#39611) ...

## Why

The fallback file contains OAuth credentials, so it must be private from the
moment it is created and writes must not follow links to another path.

## What changed

- Create the fallback file with mode `0600` on Unix before writing credentials.
- Reject symlinks and other non-regular files on Unix and Windows, including
  Windows reparse points.
- Truncate and update an existing regular file through the validated file
  handle, restoring private Unix permissions when needed.

## Testing

Added coverage for creation under a permissive umask, updates through an
existing hard link, permission restoration, and symlink rejection.

GitOrigin-RevId: d3e4be52e8f4cebb66c59d496a7f77a952a2d0d9

2026-08-20 06:17:48 +00:00

..

src

Harden MCP OAuth fallback credential writes (#39611)

2026-08-20 06:17:48 +00:00

tests

Expand OAuth metadata redirect test coverage (#39320)

2026-08-19 00:05:23 +00:00

BUILD.bazel

[3/4] Add executor-backed RMCP HTTP client (#18583)

2026-04-22 17:38:04 -07:00

Cargo.toml

Harden MCP OAuth fallback credential writes (#39611)

2026-08-20 06:17:48 +00:00