T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:7- Finding
Sensitive Health Records Stored Without Enforced File Permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh:7-8,scripts/script.sh:62-94, andscripts/script.sh:130-300
Vulnerability Type: Plaintext sensitive-data storage with insufficient access-control enforcement
Risk Level: MediumVulnerable Code
bash DATA_DIR="${HOME}/.local/share/heartrate" mkdir -p "$DATA_DIR" _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }The export function also creates plaintext reports without explicitly restricting their permissions:
bash _export() { local fmt="${1:-json}" local out="$DATA_DIR/export.$fmt" case "$fmt" in json) echo "[" > "$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ;; txt) echo "=== Heartrate Export ===" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue echo "--- $(basename "$f" .log) ---" >> "$out" cat "$f" >> "$out" done ;; *) echo "Formats: json, csv, txt"; return 1 ;; esac echo "Exported to $out ($( ...[truncated 3130 chars]- Remediation
View remediation
Remediation Suggestions
-
Set an owner-only umask before creating any data:
bash umask 077 -
Create and normalize the data directory with owner-only permissions:
bash DATA_DIR="${HOME}/.local/share/heartrate" mkdir -p -m 700 "$DATA_DIR" chmod 700 "$DATA_DIR" -
Ensure every existing and newly generated log or export file is owner-readable and owner-writable only:
bash chmod 600 "$DATA_DIR"/*.log "$DATA_DIR"/export.* 2>/dev/null || true -
Create export files securely rather than relying solely on ordinary redirection. Create a temporary owner-only file within the protected directory, write the complete report, and atomically rename it to the destination.
-
Check the ownership of an existing data directory before using it. Refuse operation if it is not owned by the current user or if unsafe group/other write permissions are present.
-
Consider optional encryption at rest for health records and exports where the threat model includes privileged local users, device theft, or filesystem backup exposure. File permissions alone do not protect against administrators or offline disk access.
-