# no-permissive-file-permission

Disallow world-writable and decimal file permission literals

World-writable permissions let every local user modify the created entry, while decimal notation obscures the selected mode bits.
Instead, you SHOULD grant only the required permissions and write mode literals in octal notation.

- Category: security
- Level: warning
- Fix: none
- Scope: module

## Reported

```ds title="main.ds"
import { FileMode } from "destack:fs/binding";

const mode = FileMode(0o666);
```

## Accepted

```ds title="main.ds"
import { FileMode } from "destack:fs/binding";

const mode = FileMode(0o640);
```

## Prior art

- [Clippy · non_octal_unix_permissions](https://rust-lang.github.io/rust-clippy/master/index.html#non_octal_unix_permissions)
- [Ruff · bad-file-permissions](https://docs.astral.sh/ruff/rules/bad-file-permissions/)

[language/linter/src/rules/security/no_permissive_file_permission.rs:8](https://github.com/destack-sh/destack/blob/main/language/linter/src/rules/security/no_permissive_file_permission.rs#L8)