T09 · Insecure Skill Coding Practices
Error
- Location
scripts/scaffold_neo_app.sh:8- Finding
Unvalidated Scaffold Paths Permit File Creation and Overwrite Outside the Intended Directory
- Content
View full analysis
[--path apps] [--with-auth jwt]" exit 1 fi ROOT="$BASE_PATH/$NAME" FRONTEND="$ROOT/frontend" BACKEND="$ROOT/backend" mkdir -p "$FRONTEND/src" "$FRONTEND/public" mkdir -p "$BACKEND/src" "$BACKEND/src/config" "$BACKEND/src/models" "$BACKEND/src/controllers" "$BACKEND/src/routes" "$BACKEND/src/middlewares" cat > "$ROOT/README.md" <` redirections throughout the script, which overwrite existing destination files. ### Technical Analysis The script accepts `BASE_PATH` and `NAME` without validating their contents or canonicalizing the resulting path. A project name can contain `..` path components, while `--path` can directly designate any writable directory. The computed `ROOT` is never checked to ensure that it remains under the intended scaffold directory. Although variable expansion is quoted and therefore does not directly permit shell command injection, quoting does not prevent directory traversal. Shell output redirection also follows symbolic links and truncates an existing destination file before writing to it. The script does not reject an existing project directory, pre-existing files, or symbolic links. This violates the expected filesystem boundary of a scaffolding operation and allows user-controlled arguments to determine where files are created or overwritten. ### Attack Path 1. An attacker or untrusted caller supplies a crafted project path, for example: ```bash bash s ...[truncated 1271 chars]- Remediation
View remediation
&2 exit 1 fi ``` 2. Resolve `BASE_PATH` and `ROOT` to canonical absolute paths, then verify that `ROOT` is a strict descendant of the approved base directory. 3. If arbitrary `--path` values are not required, remove that option and use a fixed trusted output directory. 4. Reject `NAME` values containing `/`, `\`, `.` path segments, control characters, or traversal components. 5. Refuse to operate when the target project directory already exists rather than silently overwriting its contents. 6. Detect and reject symbolic links in every destination path component. 7. Use safe option termination, such as `mkdir -p -- "$path"`, for filesystem commands. 8. Create files exclusively where possible, for example by enabling `noclobber` or using an atomic exclusive-creation mechanism. 9. Add tests covering absolute paths, `../` traversal, existing destinations, and symbolic-link destinations. ]]>