Description

write_config() created ~/.config/censys and wrote censys.cfg without an explicit mode, so permissions were governed solely by the process umask. Under the common default umask of 022, the config file — which holds api_id, api_secret, and asm_api_key in plaintext — ended up world-readable (0644) and the directory world-traversable (0755). On shared hosts, any local unprivileged user could read the victim's live API credentials (CWE-276, Incorrect Default Permissions).

This change hardens write_config() so it no longer inherits the ambient umask:

• The config directory is created with mode 0700 (and chmod'd to 0700 if it already exists).
• The config file is created with mode 0600 via an opener that passes 0o600 to os.open(), and any pre-existing file is chmod'd to 0600 before credentials are written to it.

Fixes GHSA-xm52-gr3v-ffpq (internal ticket: IIP-22870).

Changes

• Updated censys/common/config.py: write_config() now creates the config directory 0700, creates the config file 0600, and tightens permissions on pre-existing files/directories on rewrite.
• Updated tests/cli/test_config.py: adjusted existing assertions for the new open()/makedirs() calls and added test_write_config_restricts_permissions, a real-filesystem test verifying 0700/0600 for both fresh writes and rewrites over loose-permission files.

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes