T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/collect.py:50- Finding
Unrestricted Home-Directory Repository Discovery Violates Least Privilege
- Content
View full analysis
Vulnerability Details
File Location:
scripts/collect.py:50-53,scripts/collect.py:187-231, andscripts/collect.py:510-530
Vulnerability Type:T05: Unauthorized Access and Privilege Escalation
Risk Level: MediumVulnerable Code
python def get_default_search_dirs() -> list: """ Return search directories. Strategy: scan the ENTIRE home directory. No hardcoded guessing — we find ALL repos wherever they are, including hidden directories like .qclaw, .gongfeng-copilot, etc. """ home = get_home() dirs = [home] # Start from HOME, the script will walk into all subdirspython def discover_repos(search_dirs: list, exclude_dirs: set, max_depth: int) -> list: """ Walk through search directories and find ALL git repositories, including those in hidden directories (e.g. .qclaw, .gongfeng-copilot). Cross-platform, uses os.walk instead of shell commands. """ repos = [] seen = set() # Merge user-configured excludes with global excludes all_excludes = GLOBAL_EXCLUDE_DIRS | exclude_dirs for search_dir in search_dirs: search_dir = Path(search_dir) if not search_dir.is_dir(): continue base_depth = len(search_dir.parts) for root, dirs, _files in os.walk(str(search_dir)): root_path = Path(root) current_depth = len(root_path.parts) - base_depth # Prune depth if current_depth >= max_depth: dirs.clear() continue # Check if this directory is a git repo if ".git" in dirs: try: repo_path = root_path.resolve() except OSError: continue repo_key = str(repo_path) if repo_key not in seen: seen.add(repo_key) repos.append(repo_path) # Don't recurse deeper into this repo's subdirs ...[truncated 3277 chars]- Remediation
View remediation
Remediation Suggestions
- Default repository discovery to the current working directory or active workspace rather than the entire home directory.
- Require explicit user consent before enabling home-wide recursive discovery.
- Support an allowlist of approved repository roots and reject paths outside those roots.
- Skip hidden directories by default and provide an explicit opt-in option for scanning them.
- Present discovered repositories to the user for confirmation before collecting commit metadata.
- Add command-line options such as
--workspace,--repo, and--scan-home, with--scan-homedisabled by default. - Avoid emitting absolute repository paths unless they are required; use repository names or redacted paths in normal output.
- Document the precise data collected and where the generated JSON or report may be stored.