T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/jlm-coffee.py:18- Finding
Predictable Shared Temporary Cache Permits Cache Poisoning and Symlink-Based File Overwrite
- Content
View full analysis
CACHE_TTL: return None with open(CACHE_FILE, "r", encoding="utf-8") as f: return json.load(f) except (json.JSONDecodeError, OSError): return None def _write_cache(shops): """Write shops list to cache file.""" try: os.makedirs(CACHE_DIR, exist_ok=True) with open(CACHE_FILE, "w", encoding="utf-8") as f: json.dump(shops, f, ensure_ascii=False) except OSError: pass # cache is best-effort ``` ### Technical Analysis The application stores cached data at the fixed, predictable path `/tmp/jlm-coffee/shops.json` on typical Linux systems. The system temporary directory is commonly shared among local users. Neither the cache directory nor the cache file is validated for ownership, file type, or symbolic-link status. The calls to `os.path.getmtime()` and `open()` follow symbolic links. The directory is also created without explicitly enforcing private permissions. This creates two related risks: 1. **Cache poisoning:** A local attacker can create the predictable cache file before the victim runs the application. If its modification time is sufficiently recent and its contents are valid JSON, `_read_cache()` trusts the attacker-controlled data. 2. **Symlink-based overwrite:** An attacker can place a symbolic link at the cache path. When `_write_cache()` ...[truncated 2342 chars]- Remediation
View remediation