T09 · Insecure Skill Coding Practices
- Location
scripts/check.sh:72- Finding
Configuration-Controlled Path Traversal in Snapshot Storage
- Content
View full analysis
Vulnerability Details
File Location:
scripts/check.sh, lines 72–75 and 89–120
Vulnerability Type: Path traversal through unvalidated configuration values
Risk Level: MediumVulnerable Code
bash comp_id=$(echo "$competitor_json" | jq -r '.id') comp_name=$(echo "$competitor_json" | jq -r '.name') comp_tier=$(echo "$competitor_json" | jq -r '.tier') comp_pages=$(echo "$competitor_json" | jq -c '.pages') echo "$comp_pages" | jq -c 'to_entries[]' | while IFS= read -r page_entry; do page_name=$(echo "$page_entry" | jq -r '.key') page_url=$(echo "$page_entry" | jq -r '.value') # ... comp_snapshot_dir="$SNAPSHOT_DIR/$comp_id/$page_name" mkdir -p "$comp_snapshot_dir" timestamp=$(date +"%Y-%m-%d-%H%M%S") new_snapshot_file="$comp_snapshot_dir/$timestamp.txt" echo " - Saving snapshot to $new_snapshot_file" if [ "$DRY_RUN" = false ]; then echo "$new_content" > "$new_snapshot_file" fiTechnical Analysis
The competitor ID and page name are read from the editable JSON configuration and used directly as path components. The script does not validate them against an allowlist, reject path separators, canonicalize the resulting path, or verify that it remains under
SNAPSHOT_DIR.Shell quoting prevents these values from being split into commands, but it does not prevent filesystem traversal. A value containing components such as
../can cause the operating system to resolve the snapshot path outside the intended data directory. An absolute page key may also undermine the intended directory layout, depending on how the resulting path is composed and normalized.The normal
add-competitor.shworkflow generates constrained competitor IDs, butconfig.jsonis explicitly intended to be edited by users and could also be replaced or generated by another process. Therefore,check.shmust not assume that configuration path components are sa ...[truncated 1385 chars]- Remediation
View remediation
Remediation Suggestions
- Validate every competitor ID and page key before using it as a path component. Use a strict allowlist such as
^[A-Za-z0-9_-]+$. - Reject empty values,
.and.., slash characters, backslashes, control characters, and absolute paths. - Canonicalize both
SNAPSHOT_DIRand the proposed destination withrealpathor an equivalent mechanism. - Verify that the canonical destination begins with the canonical snapshot directory followed by a path separator.
- Abort rather than silently processing an unsafe configuration entry.
- Apply restrictive directory permissions, such as mode
0700, to reduce access from other local users. - Perform validation in
check.sheven ifadd-competitor.shalso validates input, because the configuration can be edited independently.
Example validation:
bash validate_component() { local value="$1" [[ "$value" =~ ^[A-Za-z0-9_-]+$ ]] || { log_error "Unsafe snapshot path component: $value" } } validate_component "$comp_id" validate_component "$page_name" snapshot_root=$(realpath -m "$SNAPSHOT_DIR") comp_snapshot_dir=$(realpath -m "$SNAPSHOT_DIR/$comp_id/$page_name") case "$comp_snapshot_dir/" in "$snapshot_root/"*) ;; *) log_error "Snapshot path escapes the configured data directory." ;; esac- Validate every competitor ID and page key before using it as a path component. Use a strict allowlist such as