T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:6- Finding
Predictable Data Files Permit Symbolic-Link File Overwrite
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` The export function also writes directly to predictable paths: ```bash _export() { local fmt="${1:-json}" local out="$DATA_DIR/export.$fmt" case "$fmt" in json) echo "[" > "$out" ``` Entry commands similarly append directly to predictable log names: ```bash echo "$ts|$input" >> "$DATA_DIR/add.log" ``` ### Technical Analysis The script creates or reuses `~/.local/share/scheduler` without setting a restrictive `umask`, explicitly enforcing mode `0700`, validating directory ownership, or verifying that the directory and destination files are not symbolic links. Shell output redirection follows symbolic links. Predictable destinations such as `history.log`, `add.log`, and `export.json` are therefore unsafe when another local principal can modify the data directory. This condition could arise from an unsafe process umask, pre-existing permissive permissions, incorrect ownership, or another process that has access to the directory. The script also writes exports directly to their final destination. It does not use a securely created temporary file followed by an atomic rename, leaving the operation exposed to time-of-check/time-of-use and replacement races. ### Attack Path 1. The scheduler data directory exists with permissions that allow an attacker or another compromised local process to create or replace files within it. 2. The attacker creates a predictable destination, such as `export.json` or `history.log`, as a symbolic link to another file writable by the victim. 3. The victim invokes an affected operation, such as `scheduler export json` or `scheduler ad ...[truncated 801 chars]- Remediation
View remediation