WorldWritablePermission

warning native off by default

Group: Security

World-write permission lets other users modify a configured sensitive file. Remove that permission when the project's file policy forbids it. This inspection is disabled by default because the intended policy or use can vary.

Example

<?php
chmod("/srv/app/config.php",0777);

mkdir(directory:"/srv/app/.env", permissions:0777);

chmod("/srv/app/server.pem", 0644 | 0002);

Reported:

• line 2: Remove world-write permission from sensitive files.
• line 4: Remove world-write permission from sensitive files.
• line 6: Remove world-write permission from sensitive files.

Detection

• Resolved chmod/mkdir mode is a constant mask with other-write bit 0002. The mask may be one integer or a parenthesised or bit-or (|) combination of constant integers, e.g. 0644 | 0002; every operand must be known. Require path matched against configured sensitive path globs (default **/*.pem, **/.env, **/config.php) and a statically known literal path. Unknown paths excluded.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• A bit-or mode with any non-constant operand is unknown and is not reported, even when another operand carries bit 0002; other operators are not folded. A known combination without bit 0002 (0640 | 0004) is valid.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Options

Option	Type	Default	Effect
sensitivePaths	list	["**/*.pem", "**/.env", "**/config.php"]	Globs of the sensitive paths whose world-writable modes are reported.

Configure

In custos.json:

{
  "rules": {
    "WorldWritablePermission": {
      "enabled": true,
      "options": {
        "sensitivePaths": ["**/*.pem","**/.env","**/config.php"]
      }
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore WorldWritablePermission