fix: us secure randomized temporary directories in chart downloader

Signed-off-by: Kartik Kenchi <kartikbkenchi@gmail.com>

pkg/cmd/dependency_update_test.go

@@ -206,9 +206,14 @@ func TestDependencyUpdateCmd_DoNotDeleteOldChartsOnError(t *testing.T) {
 	}
 
 	// Make sure tmpcharts-x is deleted
-	tmpPath := filepath.Join(dir(chartname), fmt.Sprintf("tmpcharts-%d", os.Getpid()))
-	if _, err := os.Stat(tmpPath); !errors.Is(err, fs.ErrNotExist) {
-		t.Fatal("tmpcharts dir still exists")
+	entries, err := os.ReadDir(dir(chartname))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, entry := range entries {
+		if entry.IsDir() && strings.HasPrefix(entry.Name(), "tmpcharts-") {
+			t.Fatalf("tmpcharts directory still exists: %s", entry.Name())
+		}
 	}
 }
 

pkg/downloader/manager.go

@@ -249,7 +249,6 @@ func (m *Manager) downloadAll(deps []*chart.Dependency) error {
 	}
 
 	destPath := filepath.Join(m.ChartPath, "charts")
-	tmpPath := filepath.Join(m.ChartPath, fmt.Sprintf("tmpcharts-%d", os.Getpid()))
 
 	// Check if 'charts' directory is not actually a directory. If it does not exist, create it.
 	if fi, err := os.Stat(destPath); err == nil {
@@ -265,9 +264,14 @@ func (m *Manager) downloadAll(deps []*chart.Dependency) error {
 	}
 
 	// Prepare tmpPath
-	if err := os.MkdirAll(tmpPath, 0o755); err != nil {
+	tmpPath, err := os.MkdirTemp(m.ChartPath, "tmpcharts-*")
+	if err != nil {
 		return err
 	}
+	// Maintain compatibility with existing permissions
+	if err := os.Chmod(tmpPath, 0o755); err != nil && m.Debug {
+		fmt.Fprintf(m.Out, "warning: failed to set permissions on temporary directory %s: %v\n", tmpPath, err)
+	}
 	defer os.RemoveAll(tmpPath)
 
 	fmt.Fprintf(m.Out, "Saving %d charts\n", len(deps))