From be3db57886695bfc3bc5f34cb884f2854b09fb7e Mon Sep 17 00:00:00 2001 From: Explorer09 Date: Mon, 6 Apr 2026 17:53:12 +0800 Subject: [PATCH] Don't follow symlinks when writing htop_history Prevent a symlink attack that allows an attacker to empty any file a user has write permission to. Signed-off-by: Kang-Che Sung --- History.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/History.c b/History.c index 50320abfd..6080946b5 100644 --- a/History.c +++ b/History.c @@ -69,7 +69,7 @@ void History_save(const History* this) { if (!this->filename) return; /* Settings_write writes things via a temp file & rename, we do it less robust but faster here: */ - int fd = open(this->filename, O_WRONLY | O_CREAT | O_TRUNC, 0600); + int fd = open(this->filename, O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW, 0600); if (fd == -1) return; FILE* fp = fdopen(fd, "w");