T09 · Insecure Skill Coding Practices
- Location
scripts/check-hardcoded-paths.sh:30- Finding
Ripgrep Option Injection Through an Untrusted Target Path
- Content
View full analysis
Vulnerability Details
File Location:
scripts/check-hardcoded-paths.sh, lines 30–44
Vulnerability Type: Command-line option injection
Risk Level: HighVulnerable Code
bash echo "\n--- Caminhos absolutos suspeitos: ---" rg -n "^/([a-zA-Z0-9_-]+/)+" "$SKILL_PATH" $EXCLUDE_DIRS | grep -v "/bin/" | grep -v "/usr/" | grep -v "/dev/" | grep -v "/proc/" | grep -v "/sys/" || echo "Nenhum encontrado." # Ajuste conforme necessário echo "\n--- Caminhos de usuário hardcoded (/home/, /root/): ---" rg -n "/home/[a-zA-Z0-9_-]+/|/root/" "$SKILL_PATH" $EXCLUDE_DIRS || echo "Nenhum encontrado." echo "\n--- Caminhos de sistema (/etc/, /var/, /opt/): ---" rg -n "/etc/|/var/|/opt/" "$SKILL_PATH" $EXCLUDE_DIRS || echo "Nenhum encontrado."Technical Analysis
The script accepts a target directory from its first positional argument and passes it directly to
rg. Although"$SKILL_PATH"is shell-quoted, quoting only prevents shell word splitting and metacharacter expansion. It does not prevent the invoked program from interpreting a value beginning with-or--as a command-line option.No
--option terminator is placed before the target path. Consequently, a directory name crafted to resemble a ripgrep option can be interpreted as an option rather than as the directory to scan. Execution-related ripgrep options, such as--pre=COMMAND, may cause a command to be invoked as a file preprocessor when the search runs.The initial directory check does not eliminate this issue:
bash if [ ! -d "$SKILL_PATH" ]; thenA relative directory can legitimately have a name beginning with
--, so an attacker can create such a directory and satisfy this validation.Attack Path
- An attacker creates or causes the operator to use a relative target directory whose name is also a valid execution-related ripgrep option, such as a crafted
--pre=...argument. - The operator invoke ...[truncated 1363 chars]
- An attacker creates or causes the operator to use a relative target directory whose name is also a valid execution-related ripgrep option, such as a crafted
- Remediation
View remediation
Remediation Suggestions
-
Place an explicit
--option terminator immediately before every user-controlled path:bash rg -n "$PATTERN" $EXCLUDE_OPTIONS -- "$SKILL_PATH" -
Canonicalize the supplied directory using an option-safe invocation before passing it to other tools:
bash SKILL_PATH=$(realpath -- "$1") || { echo "Error: Unable to resolve the supplied skill path." >&2 exit 1 }Converting the input to an absolute path also ensures that the resulting argument begins with
/rather than-. -
Replace the exclusion argument string with a Bash array so each option remains a deliberate argument. Use ripgrep-native glob exclusions:
bash EXCLUDE_OPTIONS=( --glob '!node_modules/**' --glob '!.git/**' --glob '!build/**' ) rg -n '/home/[a-zA-Z0-9_-]+/|/root/' \ "${EXCLUDE_OPTIONS[@]}" -- "$SKILL_PATH" -
Apply the same protection consistently to all three
rginvocations. -
Add regression tests using directories named like command-line options, including
--help,--version, and execution-related options. Tests should confirm that these values are treated exclusively as filesystem paths and cannot change ripgrep behavior. -
Run this auditing script with least privilege and inside an isolated environment when scanning attacker-controlled projects.
-