feat: add public doctor API for programmatic usage [4 of 8]

[whizzzkid]

Part 4 of 8

This is 4/8 of #265

Description of Changes (auto-gen)

• Add src/doctor/api.rs with run() and list() functions
• Update src/doctor/check.rs for API integration
• Update src/doctor/commands/run.rs to use new runner
• Update src/doctor/mod.rs with new exports
• Refactor src/doctor/runner.rs for library usage

[dryrunsecurity]

This pull request introduces insecure temporary file handling in src/doctor/commands/run.rs: the migration code uses a predictable path under world-writable /tmp (/tmp/scope/cache-file.json) without ownership or symlink checks, allowing local attackers to pre-create or replace the file with a symlink and cause arbitrary file reads or, if destination influence is possible, file overwrites.

Insecure Temporary File Handling in src/doctor/commands/run.rs

Vulnerability

Insecure Temporary File Handling

Description

The migration logic in get_cache and migrate_old_cache uses a hardcoded, predictable path in the world-writable /tmp directory (/tmp/scope/cache-file.json) without performing necessary security checks such as ownership verification or symlink detection. Since /tmp is world-writable, any local user can pre-create this directory and file. If an attacker replaces the file with a symbolic link, the tool (running as another user, potentially root) will follow the link and copy the contents of the target file to the new cache location. This leads to arbitrary file read (information disclosure) or, if the attacker can influence the destination path (e.g., via environment variables), arbitrary file overwrite.

scope/src/doctor/commands/run.rs

Lines 54 to 57 in 1fafbf3

	let old_default_cache_path = PathBuf::from("/tmp/scope/cache-file.json");
	// Handle backward compatibility: migrate from old location to new location
	let should_migrate = cache_dir != "/tmp/scope"

---

All finding details can be found in the DryRun Security Dashboard.