T09 · Insecure Skill Coding Practices
Warning
- Location
create-video.sh:27- Finding
Unvalidated Project Name Allows Path Traversal and Generated-File Corruption
- Content
View full analysis
" print_yellow "示例: remotion-bozo create my-video" exit 1 fi PROJECT_NAME=$1 PROJECT_DIR=$(pwd)/$PROJECT_NAME print_green "🎬 创建 Remotion 视频项目: $PROJECT_NAME" # 1. 创建项目目录 print_blue "📁 创建项目目录..." mkdir -p "$PROJECT_DIR" cd "$PROJECT_DIR" ``` The same untrusted value is subsequently inserted into `package.json`: ```bash # 替换项目名称 sed -i '' "s/PROJECT_NAME/$PROJECT_NAME/g" package.json ``` ### Technical Analysis The script accepts its first argument as a project name but only checks whether the argument is empty. It does not restrict path separators, parent-directory components, control characters, or characters significant to `sed`. Because `PROJECT_NAME` is appended directly to the current working directory, a value containing `../` can resolve outside the intended project workspace. Quoting `"$PROJECT_DIR"` prevents shell word splitting and glob expansion, but it does not prevent filesystem path traversal. After changing into the resulting directory, the script creates or overwrites files such as `package.json`, `tsconfig.json`, `README.md`, `src/index.tsx`, and `src/MyVideo.tsx`. The project name is also used as the replacement text in a double-quoted `sed` expression. Characters such as `/`, `&`, quotes, backslashes, or embedded newlines can alter the replacement operation or produce invalid JSON. This is not demonstrated as direct shell-command injection because the value remains within a quoted shell argument, but it can corrupt generated content and cause unintended substitutions. ### Attack Path 1. An attacker or untrusted caller supplies a crafted project name, for example: ```bash ./create-video.sh ../../target ``` 2. The script co ...[truncated 1460 chars]- Remediation
View remediation
&2 exit 1 fi ``` 2. Establish an explicit base directory, resolve the destination to a canonical path, and verify that it remains beneath that base directory before creating files. 3. Refuse to overwrite an existing non-empty destination unless the user explicitly confirms the operation. For automated use, fail closed rather than silently replacing files. 4. Avoid using `sed` to interpolate untrusted input into JSON. Generate or update `package.json` with a JSON-aware tool, such as Node.js: ```bash PROJECT_NAME="$PROJECT_NAME" node -e ' const fs = require("fs"); const path = "package.json"; const pkg = JSON.parse(fs.readFileSync(path, "utf8")); pkg.name = process.env.PROJECT_NAME; fs.writeFileSync(path, JSON.stringify(pkg, null, 2) + "\n"); ' ``` 5. Validate the normalized npm package name separately because npm package-name rules may be stricter than filesystem naming rules. 6. Test the hardened script against traversal and metacharacter inputs, including `../target`, `/tmp/target`, `.`, `..`, names containing slashes, ampersands, quotes, backslashes, and newline characters. ]]>