T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/check-hardcoded-paths.sh:30
- Finding
- Ripgrep Option Injection Through an Untrusted Target Path## Vulnerability Details **File Location**: `scripts/check-hardcoded-paths.sh`, lines 30–44 **Vulnerability Type**: Command-line option injection **Risk Level**: High ### Vulnerable Code ```bash echo "\n--- Caminhos absolutos suspeitos: ---" rg -n "^/([a-zA-Z0-9_-]+/)+" "$SKILL_PATH" $EXCLUDE_DIRS | grep -v "/bin/" | grep -v "/usr/" | grep -v "/dev/" | grep -v "/proc/" | grep -v "/sys/" || echo "Nenhum encontrado." # Ajuste conforme necessário echo "\n--- Caminhos de usuário hardcoded (/home/, /root/): ---" rg -n "/home/[a-zA-Z0-9_-]+/|/root/" "$SKILL_PATH" $EXCLUDE_DIRS || echo "Nenhum encontrado." echo "\n--- Caminhos de sistema (/etc/, /var/, /opt/): ---" rg -n "/etc/|/var/|/opt/" "$SKILL_PATH" $EXCLUDE_DIRS || echo "Nenhum encontrado." ``` ### Technical Analysis The script accepts a target directory from its first positional argument and passes it directly to `rg`. Although `"$SKILL_PATH"` is shell-quoted, quoting only prevents shell word splitting and metacharacter expansion. It does not prevent the invoked program from interpreting a value beginning with `-` or `--` as a command-line option. No `--` option terminator is placed before the target path. Consequently, a directory name crafted to resemble a ripgrep option can be interpreted as an option rather than as the directory to scan. Execution-related ripgrep options, such as `--pre=COMMAND`, may cause a command to be invoked as a file preprocessor when the search runs. The initial directory check does not eliminate this issue: ```bash if [ ! -d "$SKILL_PATH" ]; then ``` A relative directory can legitimately have a name beginning with `--`, so an attacker can create such a directory and satisfy this validation. ### Attack Path 1. An attacker creates or causes the operator to use a relative target directory whose name is also a valid execution-related ripgrep option, such as a crafted `--pre=...` argument. 2. The operator invoke ...[truncated 1363 chars]
- Remediation
- ## Remediation Suggestions 1. Place an explicit `--` option terminator immediately before every user-controlled path: ```bash rg -n "$PATTERN" $EXCLUDE_OPTIONS -- "$SKILL_PATH" ``` 2. Canonicalize the supplied directory using an option-safe invocation before passing it to other tools: ```bash SKILL_PATH=$(realpath -- "$1") || { echo "Error: Unable to resolve the supplied skill path." >&2 exit 1 } ``` Converting the input to an absolute path also ensures that the resulting argument begins with `/` rather than `-`. 3. Replace the exclusion argument string with a Bash array so each option remains a deliberate argument. Use ripgrep-native glob exclusions: ```bash EXCLUDE_OPTIONS=( --glob '!node_modules/**' --glob '!.git/**' --glob '!build/**' ) rg -n '/home/[a-zA-Z0-9_-]+/|/root/' \ "${EXCLUDE_OPTIONS[@]}" -- "$SKILL_PATH" ``` 4. Apply the same protection consistently to all three `rg` invocations. 5. Add regression tests using directories named like command-line options, including `--help`, `--version`, and execution-related options. Tests should confirm that these values are treated exclusively as filesystem paths and cannot change ripgrep behavior. 6. Run this auditing script with least privilege and inside an isolated environment when scanning attacker-controlled projects.