T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/execute-task.sh:24- Finding
Directory Traversal Through an Unvalidated Feature Name
- Content
View full analysis
[task-id|--status]" echo "" echo "Commands:" echo " Show next pending task with context" echo " Execute specific task (e.g., T-003)" echo " --status Show progress summary" echo "" echo "Examples:" echo " ./execute-task.sh user-auth" echo " ./execute-task.sh user-auth T-003" echo " ./execute-task.sh user-auth --status" exit 0 fi SPEC_DIR=".spec-flow/active/$FEATURE_NAME" if [ ! -d "$SPEC_DIR" ]; then echo -e "${RED}Error: Spec directory not found: $SPEC_DIR${NC}" echo "Available specs:" ls -1 .spec-flow/active/ 2>/dev/null || echo " (none)" exit 1 fi TASKS_FILE="$SPEC_DIR/tasks.md" if [ ! -f "$TASKS_FILE" ]; then echo -e "${RED}Error: tasks.md not found in $SPEC_DIR${NC}" exit 1 fi ``` ### Technical Analysis `FEATURE_NAME` is incorporated directly into `SPEC_DIR` without syntactic validation or canonical path containment checks. Consequently, path components such as `../` are accepted and can cause the resolved directory to escape `.spec-flow/active/`. The initialization script prevents this condition by enforcing `^[a-z0-9-]+$`, but `execute-task.sh` does not apply the same validation. Quoting the resulting path prevents shell word splitting and command substitution, but it does not prevent filesystem path traversal. After accepting the escaped directory, the script reads `tasks.md` and may also read `design.md` and `requirements.md`. Its parsing and context-display functions print selected content from these ...[truncated 1484 chars]- Remediation
View remediation