T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/send_voice.sh:121- Finding
Predictable Shared Temporary Files Permit File Overwrites and Cross-Request Data Exposure
- Content
View full analysis
/dev/null 2>&1 if [ ! -f /tmp/feishu-voice-temp.mp3 ]; then echo "❌ TTS 生成失败" exit 1 fi ``` ```bash ffmpeg -y -i /tmp/feishu-voice-temp.mp3 \ -filter:a "atempo=$SPEED" \ -c:a libmp3lame -q:a 2 \ /tmp/feishu-voice-speed.mp3 > /dev/null 2>&1 mv /tmp/feishu-voice-speed.mp3 /tmp/feishu-voice-temp.mp3 ``` ```bash ffmpeg -y -i /tmp/feishu-voice-temp.mp3 \ -c:a libopus \ -b:a 24k \ /tmp/feishu-voice.opus > /dev/null 2>&1 ``` ```bash rm -f /tmp/feishu-voice-temp.mp3 /tmp/feishu-voice-speed.mp3 /tmp/feishu-voice.opus 2>/dev/null || true ``` ### Technical Analysis The script stores generated and processed audio under fixed, globally predictable paths in `/tmp`. It does not create a private temporary directory, verify file ownership, reject symbolic links, or ensure that output files were newly created by the current process. The use of `ffmpeg -y` is particularly significant because it enables unconditional replacement of existing output files. If an attacker can pre-create one of the predictable paths as a symbolic link, FFmpeg may follow that link and overwrite another file writable by the user running the Skill. The fixed names also make concurrent executions unsafe. Two invocations can read, replace, upload, or delete the same files, potentially causing one user's generated audio to be sent in another user's message. Cleanup is performed only after successful completion. Because the script uses `set -e` without an `EXIT` trap, errors during TTS generation, conversion, probing, upload, or message delivery can leave speech files in `/tmp`. Their accessibility depends on the process umask and local system configuration. ### Attack Pa ...[truncated 1556 chars]- Remediation
View remediation
&2 exit 1 } chmod 700 "$TMP_DIR" trap 'rm -rf -- "$TMP_DIR"' EXIT INT TERM HUP TEMP_MP3="$TMP_DIR/voice-temp.mp3" SPEED_MP3="$TMP_DIR/voice-speed.mp3" OPUS_FILE="$TMP_DIR/voice.opus" ``` Use these variables for every TTS, FFmpeg, FFprobe, curl, and cleanup operation. Additional hardening should include: 1. Set a restrictive umask before creating files: ```bash umask 077 ``` 2. Do not place sensitive audio directly under shared, predictable `/tmp` paths. 3. Use the `EXIT` trap so cleanup also occurs after failures. 4. Verify that generated outputs are regular files owned by the current user before reading or uploading them: ```bash [ -f "$OPUS_FILE" ] && [ ! -L "$OPUS_FILE" ] || exit 1 ``` 5. Keep each invocation's files isolated to prevent collisions between concurrent executions. ]]>