T09 · Insecure Skill Coding Practices
- Location
scripts/xz01-runtime-clear.sh:3- Finding
Caller-Controlled Directory Allows Arbitrary Recursive Deletion
- Content
View full analysis
Vulnerability Details
File Location:
scripts/xz01-runtime-clear.sh, lines 3-5
Vulnerability Type: Arbitrary recursive directory deletion through insufficient path validation
Risk Level: HighVulnerable Code
bash RUNTIME="${1:-/www/wwwroot/www.900az.com/runtime}" if [[ ! -d "$RUNTIME" ]]; then echo "FAIL runtime_dir_not_found $RUNTIME" >&2; exit 2; fi find "$RUNTIME" -mindepth 1 -maxdepth 1 -exec rm -rf {} +Technical Analysis
The script accepts its deletion target from the first command-line argument. Its only safety check verifies that the supplied value identifies an existing directory. It does not canonicalize the path, enforce an allowed prefix, require the expected runtime directory, reject filesystem roots, or protect against symbolic-link and path-aliasing scenarios.
Although
-mindepth 1prevents deletion of the target directory itself, every immediate child is passed torm -rf. Because the target is caller-controlled, invoking the script with/,/home,/www, or another sensitive directory can recursively delete large portions of that directory tree.The script is intended only to clear the runtime cache at
/www/wwwroot/www.900az.com/runtime. Allowing arbitrary directories materially exceeds the minimum privilege and scope required for that declared function.Attack Path
- An attacker, unsafe automation prompt, or mistaken operator controls the script's first argument.
- The attacker supplies a sensitive existing directory, such as
/, instead of the intended runtime directory. - The
-dcheck succeeds because the supplied path exists. findenumerates every immediate child of the supplied directory.- Each child is passed to
rm -rf. - Data accessible to the executing account is recursively deleted.
Impact Assessment
The impact is destructive deletion under the privileges of the user running the Skill. If invoked as
root, this co ...[truncated 361 chars]- Remediation
View remediation
Remediation Suggestions
- Remove support for arbitrary runtime paths unless it is strictly required.
- Canonicalize the target with
realpath --canonicalize-existing. - Require exact equality with
/www/wwwroot/www.900az.com/runtime, or enforce a narrowly defined allowlist. - Explicitly reject
/,/home,/root,/www, empty paths, and any target outside the approved application directory. - Reject symbolic links and verify that every parent component resolves to the expected location.
- Consider deleting only known cache subdirectories instead of every child.
- Add a dry-run mode and require an explicit confirmation flag for any non-default target.
- Run the script under a dedicated account that has access only to the application runtime directory.
- Add automated tests proving that unsafe arguments cannot cause deletion.