tusd uploaded files permissions executable about tusd

[Acconut]

Great project, we are just starting to use it. Hope uploading implementations are a thing of the past now

Thank you a lot for these kind words :)

The uploaded files are created with the executable bit true. For everyone! -rwxr-xr-x
I would prefer them not executable.

Mostly true! Actually the file are created using 0775 (-rwxrwx-r-x), see

tusd/filestore/filestore.go

Line 31 in be8fd83

var defaultFilePerm = os.FileMode(0775)

For me this could be one part of an attack strategy with some trojan. It's clear that there has to be a second exploit at least to complete the big picture. But early intervention is king here.

Agreed, this needs to be changed.

I don't know exactly if this could be changed by the os configuration or is caused by it (Ubuntu 16.04, pretty default install). Other uploads and tmp outside of tusd are not executable.

As I mentioned above, this is hardcoded inside the source code. There is no specific reason for why we chose 0775 in the beginning.

I will address this as soon as possible!