fix(config): restrict censys.cfg to owner-only permissions

[Ben Schwartz (btschwartz12)]

Description

write_config() created ~/.config/censys and wrote censys.cfg without an explicit mode, so permissions were governed solely by the process umask. Under the common default umask of 022, the config file — which holds api_id, api_secret, and asm_api_key in plaintext — ended up world-readable (0644) and the directory world-traversable (0755). On shared hosts, any local unprivileged user could read the victim's live API credentials (CWE-276, Incorrect Default Permissions).

This change hardens write_config() so it no longer inherits the ambient umask:

• The config directory is created with mode 0700 (and chmod'd to 0700 if it already exists).
• The config file is created with mode 0600 via an opener that passes 0o600 to os.open(), and any pre-existing file is chmod'd to 0600 before credentials are written to it.

Changes

• Updated censys/common/config.py: write_config() now creates the config directory 0700, creates the config file 0600, and tightens permissions on pre-existing files/directories on rewrite.
• Updated tests/cli/test_config.py: adjusted existing assertions for the new open()/makedirs() calls and added test_write_config_restricts_permissions, a real-filesystem test verifying 0700/0600 for both fresh writes and rewrites over loose-permission files.

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[Copilot]

Pull request overview

This PR hardens config credential storage by ensuring the Censys config directory and file are created (and, when possible, tightened) with owner-only permissions to avoid leaking plaintext API credentials on shared hosts.

Changes:

• Add a restricted open() opener (0600) and best-effort chmod helper to tighten existing config paths.
• Create the default config directory with mode 0700 and attempt to chmod pre-existing directories/files to 0700/0600.
• Update CLI config tests and add real-filesystem POSIX tests verifying permissions on fresh writes and rewrites.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
censys/common/config.py	Enforces owner-only permissions for the config dir/file via mode=0o700, opener with 0o600, and best-effort chmod on rewrites.
tests/cli/test_config.py	Updates mocks for the new open(..., opener=...) / makedirs(..., mode=...) behavior and adds POSIX filesystem permission tests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Aidan Holland (thehappydinoa)]

LGTM