T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/commit_md_changes.sh:52
- Finding
- Pre-Staged Non-Matching Files Are Included in Markdown Snapshot Commits## Vulnerability Details **File Location**: `scripts/commit_md_changes.sh`, lines 52–66 **Vulnerability Type**: Failure to isolate or validate the Git index **Risk Level**: Medium ```bash # Stage only included files for p in "${CHANGED[@]}"; do git add -- "$p" || true done # Commit if anything staged if git diff --cached --quiet; then exit 0 fi git commit -m "$MSG" >/dev/null ``` ### Technical Analysis The script identifies paths matching `BRAINGIT_PATTERN` and stages those paths, but it does not isolate them from content already present in the Git index. The final `git commit -m "$MSG"` command commits the entire index, including files staged before the script was invoked. Consequently, the implementation does not enforce its documented guarantee that only matching Markdown files are committed. The `git diff --cached --quiet` check also examines the complete index rather than only the selected paths. Additionally, `git add -- "$p" || true` suppresses staging failures. This weakens fail-closed behavior because the script can continue and commit unrelated content already in the index even if staging an intended file fails. ### Attack Path 1. A non-matching file, such as source code, configuration, or a file containing sensitive data, is staged in the target repository. 2. At least one changed path matching `BRAINGIT_PATTERN` is present. 3. The script detects the matching path and attempts to stage it. 4. The script checks whether the overall index contains changes. 5. The unrestricted `git commit` command commits both the selected Markdown path and all files that were previously staged. 6. If the resulting commit is later pushed or otherwise shared, the unintended files and their historical contents can be disclosed. ### Impact Assessment Exploitation does not provide operating-system privilege escalation or access beyond the invoking user's existing repository permissions. Its scope is the targ ...[truncated 387 chars]
- Remediation
- ## Remediation Suggestions Isolate the selected paths from the caller's existing Git index before creating the commit. Recommended hardening measures include: 1. Use a temporary Git index through `GIT_INDEX_FILE`, initialize it from `HEAD`, stage only approved paths into that index, and commit using that isolated index. 2. Alternatively, inspect the existing index before staging and abort if any staged path falls outside the approved set. This is simpler but prevents operation when the caller has unrelated staged work. 3. Avoid resetting or clearing the caller's index, because doing so could destructively alter unrelated staged work. 4. Remove `|| true` from `git add -- "$p"` so that staging errors terminate execution under `set -e`. 5. Validate the isolated staged path list immediately before committing and reject any path that does not match the configured policy. 6. Add automated tests covering pre-staged non-Markdown files, staged deletions, renames, unusual filenames, and staging failures. 7. Update the documentation only after the implementation reliably enforces the stated Markdown-only commit boundary.