T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/register.js:84- Finding
Wallet path validation can escape the user's home directory
- Content
View full analysis
MAX_WALLET_FILE_SIZE) { console.error(`Security: Wallet file too large (${stat.size} bytes, max ${MAX_WALLET_FILE_SIZE})`); process.exit(1); } if (!stat.isFile()) { console.error('Security: Path must point to a regular file'); process.exit(1); } } catch (e) { // File doesn't exist — let the caller handle it } return resolved; } ``` The validated path is subsequently read as a private key: ```javascript const walletArg = getArg('--wallet'); if (walletArg) { const walletPath = validateWalletPath(walletArg.replace(/^~/, process.env.HOME)); if (fs.existsSync(walletPath)) { console.log(`Using wallet file: ${walletPath}`); const key = fs.readFileSync(walletPath, 'utf8').trim(); ``` ### Technical Analysis The containment check uses: ```javascript resolved.startsWith(home) ``` String-prefix comparison does not establish that one filesystem path is a child of another. For example, if `$HOME` is `/home/alice`, a path such as `/home/alice-backup/key` begins with the same string and passes the check even though it is outside `/home/alice`. The implem ...[truncated 1766 chars]- Remediation
View remediation