T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/stock_tools.js:10- Finding
Arbitrary File Overwrite Through Unrestricted --file Option
- Content
View full analysis
`${item.code}|${item.name}`).join('\n'); fs.writeFileSync(file, content ? `${content}\n` : '', 'utf8'); } ``` ```js function clearStocks(file) { writeStockList(file, []); } ``` ```js if (command === 'clear') { clearStocks(file); console.log('Watchlist cleared'); return; } ``` The original status message is written in Chinese, but this does not affect the vulnerability. ### Technical Analysis The `--file` argument accepts an arbitrary relative or absolute path and normalizes it with `path.resolve()`. Normalization does not constrain the path to the intended `stocks-data` directory. No canonical-path containment check, allowed-directory policy, symlink check, file-type validation, or overwrite confirmation is applied. The resulting path is passed to `writeStockList()`, which creates missing parent directories and invokes `fs.writeFileSync()`. The `clear` command supplies an empty list, causing the selected file to be truncated to zero bytes. The `add` and `remove` commands can likewise replace the selected file with attacker-influenced watchlist content. This is a direct arbitrary-file-write primitive within the permissions of the process ru ...[truncated 1777 chars]- Remediation
View remediation