T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:7- Finding
Persisted User Input May Be Readable by Other Local Users
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh:7-9, 130-294
Vulnerability Type: Insecure permissions for persistent plaintext logs
Risk Level: MediumVulnerable Code
bash DATA_DIR="${HOME}/.local/share/datasets" mkdir -p "$DATA_DIR" _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }Representative data-recording path:
bash ingest) shift if [ $# -eq 0 ]; then echo "Recent ingest entries:" tail -20 "$DATA_DIR/ingest.log" 2>/dev/null || echo " No entries yet. Use: datasets ingest <input>" else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/ingest.log" local total=$(wc -l < "$DATA_DIR/ingest.log") echo " [Datasets] ingest: $input" echo " Saved. Total ingest entries: $total" _log "ingest" "$input" fi ;;The same storage pattern is repeated for the other data commands through line 294.
Technical Analysis
The script creates its data directory and log files without establishing a restrictive
umaskor explicitly enforcing directory and file permissions. File permissions therefore depend on the caller's ambient environment.With a common
umaskof022, the directory may be created with mode0755and newly created logs with mode0644. On a multi-user system, these modes can allow other local accounts to traverse the directory and read the logs.Command input is intended to be retained in plaintext in both a category-specific log and
history.log. Consequently, dataset names, query expressions, pipeline details, file paths, or secrets accidentally supplied as command arguments may be exposed twice. The exposure is persistent and continues after the command terminates.Attack Path
- A user invokes a recording command such as
datasets ingest,datasets query, or `datasets pipelin ...[truncated 1277 chars]
- A user invokes a recording command such as
- Remediation
View remediation
Remediation Suggestions
-
Establish private permissions before creating any storage:
bash umask 077 DATA_DIR="${HOME}/.local/share/datasets" mkdir -p -m 700 "$DATA_DIR" chmod 700 "$DATA_DIR" -
Create every log with mode
0600before appending data:bash log_file="$DATA_DIR/ingest.log" touch "$log_file" chmod 600 "$log_file" printf '%s|%s\n' "$ts" "$input" >> "$log_file" -
Apply equivalent protection to
history.logand all existing category logs. Consider checking ownership before writing to prevent use of attacker-controlled preexisting paths. -
Avoid duplicating complete user input in
history.log. Store only the operation type and timestamp, or store a redacted summary. -
Document that arguments are persisted and instruct users not to provide credentials, access tokens, personal data, or other secrets.
-
Provide a retention and secure-deletion mechanism so sensitive records do not remain indefinitely.
-
Use
printfinstead ofechofor predictable handling of arbitrary input, and validate or encode record delimiters before writing structured logs.
-