T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:6- Finding
Financial Records Are Created Without Enforced Restrictive Permissions
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` Representative financial-record write: ```bash local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/record.log" local total=$(wc -l < "$DATA_DIR/record.log") echo " [Receipt] record: $input" echo " Saved. Total record entries: $total" ``` ### Technical Analysis The script stores receipt, balance, budget, expense, and tax-related information beneath `~/.local/share/receipt`, but it does not establish a restrictive `umask` or explicitly set secure modes on the directory and generated files. The resulting permissions therefore depend on the invoking process's environment. Under a common `umask` of `022`, `mkdir` can create the data directory with mode `0755`, while shell redirection can create log and export files with mode `0644`. On a multi-user host, these modes may allow other local users to traverse the directory and read the financial records. The issue affects `history.log`, command-specific `.log` files, and generated export files. The script also does not correct permissions on an existing data directory or existing files. ### Attack Path 1. A user runs commands such as `receipt record`, `receipt balance`, or `receipt tax-note`. 2. The script creates the data directory and log files using permissions derived from the current `umask`. 3. If the effective permissions allow access by group members or other users, another local account enumerates `~/.local/share/receipt`. 4. That account reads the logs or exports and obtains the stored financial and tax-related informat ...[truncated 614 chars]- Remediation
View remediation