From f732a255cedb1967810bb09cc5c7f521b70359fa Mon Sep 17 00:00:00 2001
From: smail <likb_blue@163.com>
Date: Tue, 22 Sep 2026 02:38:11 +0800
Subject: [PATCH] =?UTF-8?q?=E6=8B=86=E5=88=86=E5=86=85=E7=BD=AE=E6=8F=92?=
 =?UTF-8?q?=E4=BB=B6=E6=96=87=E4=BB=B6=E7=9A=84=E8=B7=A8=E5=B9=B3=E5=8F=B0?=
 =?UTF-8?q?=E5=AE=89=E5=85=A8=E5=88=9B=E5=BB=BA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/hooks/bundle.go              | 32 -------------------
 backend/hooks/bundle_file_linux.go   | 47 ++++++++++++++++++++++++++++
 backend/hooks/bundle_file_windows.go | 39 +++++++++++++++++++++++
 3 files changed, 86 insertions(+), 32 deletions(-)
 create mode 100644 backend/hooks/bundle_file_linux.go
 create mode 100644 backend/hooks/bundle_file_windows.go

diff --git a/backend/hooks/bundle.go b/backend/hooks/bundle.go
index d19aa9fa..ef65a0d2 100644
--- a/backend/hooks/bundle.go
+++ b/backend/hooks/bundle.go
@@ -1,9 +1,7 @@
 package hooks
 
 import (
-	"bytes"
 	"errors"
-	"io"
 	"io/fs"
 	"os"
 	"path/filepath"
@@ -52,33 +50,3 @@ func pluginRoot() (string, error) {
 	bundledRoot = root
 	return root, nil
 }
-
-func writeBundledPlugin(path string, data []byte) error {
-	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
-	if err != nil {
-		return err
-	}
-	remove := true
-	defer func() {
-		if remove {
-			_ = os.Remove(path)
-		}
-	}()
-	if _, err := io.Copy(file, bytes.NewReader(data)); err != nil {
-		_ = file.Close()
-		return err
-	}
-	if err := file.Sync(); err != nil {
-		_ = file.Close()
-		return err
-	}
-	if err := file.Chmod(0700); err != nil {
-		_ = file.Close()
-		return err
-	}
-	if err := file.Close(); err != nil {
-		return err
-	}
-	remove = false
-	return nil
-}
diff --git a/backend/hooks/bundle_file_linux.go b/backend/hooks/bundle_file_linux.go
new file mode 100644
index 00000000..17fea932
--- /dev/null
+++ b/backend/hooks/bundle_file_linux.go
@@ -0,0 +1,47 @@
+//go:build linux
+
+package hooks
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+func writeBundledPlugin(path string, data []byte) error {
+	fd, err := unix.Open(path, unix.O_WRONLY|unix.O_CREAT|unix.O_EXCL|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0600)
+	if err != nil {
+		return err
+	}
+	file := os.NewFile(uintptr(fd), path)
+	if file == nil {
+		_ = unix.Close(fd)
+		return errors.New("create bundled plugin returned an invalid file")
+	}
+	remove := true
+	defer func() {
+		if remove {
+			_ = unix.Unlink(path)
+		}
+	}()
+	if _, err := io.Copy(file, bytes.NewReader(data)); err != nil {
+		_ = file.Close()
+		return err
+	}
+	if err := file.Sync(); err != nil {
+		_ = file.Close()
+		return err
+	}
+	if err := file.Chmod(0700); err != nil {
+		_ = file.Close()
+		return err
+	}
+	if err := file.Close(); err != nil {
+		return err
+	}
+	remove = false
+	return nil
+}
diff --git a/backend/hooks/bundle_file_windows.go b/backend/hooks/bundle_file_windows.go
new file mode 100644
index 00000000..c9c48a7f
--- /dev/null
+++ b/backend/hooks/bundle_file_windows.go
@@ -0,0 +1,39 @@
+//go:build windows
+
+package hooks
+
+import (
+	"bytes"
+	"io"
+	"os"
+)
+
+func writeBundledPlugin(path string, data []byte) error {
+	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600) // #nosec G304 -- the path is an entry under a private temporary bundle root.
+	if err != nil {
+		return err
+	}
+	remove := true
+	defer func() {
+		if remove {
+			_ = os.Remove(path)
+		}
+	}()
+	if _, err := io.Copy(file, bytes.NewReader(data)); err != nil {
+		_ = file.Close()
+		return err
+	}
+	if err := file.Sync(); err != nil {
+		_ = file.Close()
+		return err
+	}
+	if err := file.Chmod(0700); err != nil {
+		_ = file.Close()
+		return err
+	}
+	if err := file.Close(); err != nil {
+		return err
+	}
+	remove = false
+	return nil
+}