[Security] Compiler host writes full unscrubbed exception to a plaintext temp file #51

Severity: CVSS 2.5 (Low) CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N · MSRC Low
Attacker: local co-tenant

Affected code

• Core/PostSharp.Compiler.Hosting/ExceptionPackagerHelper.cs:38-51

Description

On every reported exception the compiler host writes e.ToString() — the full message, all inner exceptions, and the full stack trace with absolute source/file paths (which embed the developer's username and source-tree layout) — to a plaintext file in CommonDirectory.Temp, with no scrubbing (unlike the upload path, which at least applies the denylist). The file is GUID-named and is not deleted.

Exploit scenario

On a host where the configured PostSharp temp/spool directory is shared or weakly permissioned, another local user reads PostSharp-Exception-*.txt and recovers absolute paths (usernames, project structure, internal hostnames) and any secrets present verbatim in the exception message.

Recommendation

Apply the same (ideally allowlist) scrubbing as the upload path; restrict the file to a per-user location with restrictive ACLs; delete it after the report is packaged; or gate the dump behind an explicit env var.

Severity notes

Most debatable: AC — H because the default temp is per-build/per-user (the cross-user-readable precondition is attacker-uncontrolled and non-default); on a misconfigured world-readable temp / shared CI agent, AC:L → ~4.0.

Part of #56.