T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/trackyard.sh:151- Finding
Caller-Controlled Download Path Allows Arbitrary File Overwrite
- Content
View full analysis
&2; exit 1 ;; *) track_id="$1"; shift ;; esac done if [[ -z "$track_id" ]]; then echo "Error: track ID required" >&2 exit 1 fi # Build request body local body body=$(jq -n --arg id "$track_id" '{track_id: $id}') if [[ -n "$duration" ]]; then body=$(echo "$body" | jq --argjson d "$duration" '. + {duration_seconds: $d}') fi if [[ -n "$hit_point" ]]; then body=$(echo "$body" | jq --argjson h "$hit_point" '. + {hit_point_seconds: $h}') fi # Determine output filename if [[ -z "$output" ]]; then # Get track title for filename local title title=$(curl -sS -X POST "$BASE_URL/search" \ -H "Authorization: Bearer $TRACKYARD_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"query\":\"$track_id\",\"limit\":1}" | jq -r '.tracks[0].title // "track"' 2>/dev/null || echo "track") # Sanitize filename output=$(echo "$title" | tr ' ' '_' | tr -cd '[:alnum:]_-').mp3 fi echo "Downloading to: $output" >&2 curl -sS -X POST "$BASE_URL/download-track" \ -H "Authorization: Bearer $TRACKYARD_API_KEY" \ -H "Content-Type: application/json" \ -d "$body" \ --output "$output" echo "Downloaded: $output" } ``` ### Technical Analysis The `--output` argument is accepted as an unrestricted caller-controlled filesystem path. Although automatically generated filenames are sanitized, explicitly supplied output values receive no equivalent validation. The value is pas ...[truncated 2068 chars]- Remediation
View remediation
&2 exit 1 fi destination="$download_dir/$name" if [[ -e "$destination" || -L "$destination" ]]; then echo "Error: destination already exists" >&2 exit 1 fi temporary=$(mktemp "$download_dir/.trackyard.XXXXXX") trap 'rm -f -- "$temporary"' EXIT curl --fail-with-body -sS -X POST "$BASE_URL/download-track" \ -H "Authorization: Bearer $TRACKYARD_API_KEY" \ -H "Content-Type: application/json" \ -d "$body" \ --output "$temporary" mv -- "$temporary" "$destination" trap - EXIT ``` ]]>