Open Radar

 
Summary:

When using a security-scoped bookmark, I've suddenly found that Mavericks beta 4 only gives my security-scoped bookmarks read-only access to the files they should have access to.

The code for this works fine in Mountain Lion, and worked up until now in Developer Preview 4. Removing and re-adding the file within the UI or with a PowerBox NSOpenPanel gives me access again, but restoring from a security-scoped URL doesn't give me write access.

Steps to Reproduce:

• Create new project
• Ensure it's sandboxed and signed
• Ensure "User Selected File" is set to Read/Write (com.apple.security.files.user-selected.read-write)
• Set ApplicationDelegate to the contents of https://gist.github.com/elliottkember/6079285
• Create a directory on the desktop with "index.html" in it
• Run the app. An openPanel should show. Select the directory on the desktop.
• Quit the app and re-run. The bookmarkData is restored from the UserPreferences, startAccess is called, and then we try and write to a file called "testing.html".

Expected Results:

• We should see "Success reading (path)/index.html: (length)" showing the length of index.html

Actual Results:

• Log message of "Write access denied." as createFileAtPath returns NO instead of YES.
• Console.log shows error: Write error: Error Domain=NSCocoaErrorDomain Code=513 "You don’t have permission to save the file “index.html” in the folder “z”." UserInfo=0x100254070 {NSFilePath=/Users/elliott/Desktop/z/index.html, NSUnderlyingError=0x100253c90 "The operation couldn’t be completed. Operation not permitted"}

Regression:

• Works in OSX Mountain Lion and earlier, and no problems reported with Mavericks until Developer Preview 4.

Notes: 

I've tried all sorts of fileURL / URL combinations with this, as well as other flags for creating the security-scoped bookmark, but with no luck. It's quite suspicious that something like this would show up four releases into a beta version of the OS, so I'm curious as to what the cause is!

Setting com.apple.security.files.downloads.read-write to YES and using a directory inside the Downloads folder works fine.