.htaccess file is writable, using the current Securing file permissions and ownership doc page

Problem/Motivation

After following the guidelines on the Securing file permissions and ownership documentation page, and running this module, the report says "PHP files in the Drupal files directory can be executed.".

On the "Executable PHP" page it says:

The Drupal files directory is for user-uploaded files and by default provides some protection against a malicious user executing arbitrary PHP code against your site. Read more about the risk of PHP code execution on Drupal.org.

The .htaccess file is writable which poses a risk should a malicious user find a way to execute PHP code they could alter the .htaccess file to allow further PHP code execution.

From /admin/reports/security-review/help/security_review/executable_php.

.htaccess is 660:

$ ls -al web/sites/default/files | grep .htacces
-rw-rw----   1 user      www-data     486 12 feb  2025 .htaccess

Setting it to read-only seems to satisfy Security Review:

$ chmod 440 web/sites/default/files/.htaccess
$ ls -al web/sites/default/files | grep .htacces
-r--r-----   1 user      www-data     486 12 feb  2025 .htaccess

The report goes green and says:

"PHP files in the Drupal files directory cannot be executed."

The permission is probably set by the last line, from the Securing file permissions and ownership doc page:

$ cd /var/www/example.org/public_html/web/sites
$ find . -type d -name files -exec chmod ug=rwx,o= '{}' \;
$ find ./*/files -type d -exec chmod ug=rwx,o= '{}' \;
$ find ./*/files -type f -exec chmod ug=rw,o= '{}' \;

Is that correct, or should we recommend another command?

Steps to reproduce

Proposed resolution

1. Check if the documentation is correct:
   ✅ Yes, it is correct.

   For Drupal to protect against PHP file execution in the Drupal files directory then a .htaccess file needs to exist with the following content and not be writeable by the webserver.

   From Preventing execution of untrusted PHP.

2. Check if the recommended steps to secure folders and files is correct:
   ✅ Command to make .htaccess read-only could be added, and it has been, as seen below.

   For the "files" directory in the sites/default directory and any other site directories in a multi-site installation, the permissions are slightly different because the www-data user must have write permission to the directory:

   $ cd /var/www/example.org/public_html/web/sites
   $ find . -type d -name files -exec chmod ug=rwx,o= '{}' \;
   $ find ./*/files -type d -exec chmod ug=rwx,o= '{}' \;
   $ find ./*/files -type f -exec chmod ug=rw,o= '{}' \;
   $ find ./*/files/.htaccess -type f -exec chmod ug=r,o= '{}' \;
   

   From Securing file permissions and ownership.

3. Verify if the check in the code is correct:
   ✅ It works well, and as intended.

   if ($writable_htaccess) {
     $findings[] = 'writable_htaccess';
     if ($result !== CheckResult::FAIL) {
       $result = CheckResult::WARN;
     }
   }
   

   From https://git.drupalcode.org/project/security_review/-/blob/3.1.x/src/Plug....

4. We could include "... and Securing file permissions and ownership" in the src/Plugin/SecurityCheck/ExecutablePhp.php message, to give the users a solution?
   ✅ The MR has been committed.

Remaining tasks

User interface changes

API changes

Data model changes