T09 · Insecure Skill Coding Practices
- Location
scripts/bilibili_ai_subtitle.sh:109- Finding
Predictable Temporary File Allows Symlink-Based File Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
scripts/bilibili_ai_subtitle.sh, lines 109–123
Vulnerability Type: Predictable temporary file and unsafe symbolic-link handling
Risk Level: MediumVulnerable Code
bash " "$VIDEO_TITLE" "$VIDEO_AUTHOR" > /tmp/safe_name_$$ SAFE_NAME=$(cat /tmp/safe_name_$$) DATE_SHORT=$(echo "$VIDEO_DATE" | sed 's/-//g') # Simplify duration DURATION_SIMPLE=$(echo "$VIDEO_DURATION" | sed 's/分/./g; s/秒//g') [ -z "$SAFE_NAME" ] && SAFE_NAME="video_unknown" # Filename: video title, uploader, date, duration, and BVID FILENAME="${SAFE_NAME}_${DATE_SHORT}_${DURATION_SIMPLE}_${BVID}.txt" OUTPUT_FILE="${OUTPUT_DIR}/${FILENAME}" rm -f /tmp/safe_name_$$The first line shown is the closing portion of a multiline
python3 -ccommand whose standard output is redirected to the temporary path.Technical Analysis
The script constructs a temporary filename in the shared
/tmpdirectory using the process ID:bash /tmp/safe_name_$$A process ID is predictable and does not provide secure uniqueness. The file is opened through ordinary shell redirection without atomic exclusive creation, ownership verification, restrictive permissions, or symbolic-link rejection. If the path already exists as a symbolic link, the shell follows that link when processing
>, truncating and writing to its target with the privileges of the user running the script.The subsequent
catandrmoperations do not mitigate the initial unsafe write. In addition,rmremoves the symbolic link itself rather than reversing modifications made to its target.Exploitation requires local access sufficient to create entries in
/tmp, an ability normally available to local users. The attacker must predict or observe the victim process ID and win the race before the redirection occurs.Attack Path
- A local attacker predicts or observes the process ID that will be assigned to the script.
- The attacker creates `/tmp/safe_name_<PI ...[truncated 1194 chars]
- Remediation
View remediation
Remediation Suggestions
Avoid creating the temporary file because the Python output can be captured directly:
bash SAFE_NAME=$(python3 -c ' import sys title = sys.argv[1] author = sys.argv[2] # Apply the existing sanitization logic here. print(f"{title}_{author}") ' "$VIDEO_TITLE" "$VIDEO_AUTHOR") || exit 1If a temporary file is necessary:
- Create it atomically with
mktemprather than constructing a PID-based path. - Restrict permissions with
umask 077. - verify that
mktempsucceeded before writing. - Register a quoted cleanup trap immediately after creation.
- Do not use a caller-controlled directory for security-sensitive temporary files.
Example:
bash umask 077 SAFE_NAME_FILE=$(mktemp "${TMPDIR:-/tmp}/bilibili-safe-name.XXXXXX") || { echo "Failed to create a secure temporary file" >&2 exit 1 } trap 'rm -f -- "$SAFE_NAME_FILE"' EXIT HUP INT TERM python3 -c '...' "$VIDEO_TITLE" "$VIDEO_AUTHOR" > "$SAFE_NAME_FILE" || exit 1 SAFE_NAME=$(cat -- "$SAFE_NAME_FILE") || exit 1Direct command substitution is preferable because it removes the temporary-file attack surface entirely.
- Create it atomically with