T09 · Insecure Skill Coding Practices
Error
- Location
scripts/health_check.sh:9- Finding
Predictable Temporary State File Allows Symlink-Based File Corruption
- Content
View full analysis
/dev/null | tr -d '[]' | tr ',' '\n' | grep -v '^$' | sort -n) fi # Filter records from the last 60 seconds local recent=$(echo "$timestamps" | awk -v c="$cutoff" '$1 > c' | wc -l) if [[ "$recent" -ge 40 ]]; then echo "Rate limit reached" exit 0 fi # Write the current timestamp echo "$now," >> "$RATE_LIMIT_FILE" # Remove expired records if [[ -f "$RATE_LIMIT_FILE" ]]; then local tmp=$(mktemp) awk -v c="$cutoff" '$1 > c' "$RATE_LIMIT_FILE" > "$tmp" && mv "$tmp" "$RATE_LIMIT_FILE" fi } ``` ### Technical Analysis The script stores rate-limit state at the fixed path `/tmp/guardian_rate_limit.json`. The `/tmp` directory is normally writable by every local user. The script neither creates a private parent directory nor verifies that the destination is a regular file owned by the expected user. The append operation: ```bash echo "$now," >> "$RATE_LIMIT_FILE" ``` follows symbolic links. If this health check is run as root, a local unprivileged user can create `/tmp/guardian_rate_limit.json` as a symbolic link to a root-writable target. The privileged script will then append a timestamp and comma to that target. Creating a separate temporary file with `mktemp` later in the function does not prevent the initial append from following the symbolic link. It also does not provide safe concurrency control for multiple health-check instances. The attacker cannot select arbitrary output content: the appended content is limit ...[truncated 1377 chars]- Remediation
View remediation