T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/todo.sh:100- Finding
Predictable Temporary Files Permit Symlink-Based File Overwrites
- Content
View full analysis
"$tmp_file" && mv "$tmp_file" "$TODO_FILE" fi } ``` The same unsafe temporary-file construction is used elsewhere: ```bash local tmp_file="${TODO_FILE}.tmp.$$" awk -v section="$section" -v entry="$entry" '...' "$TODO_FILE" > "$tmp_file" && mv "$tmp_file" "$TODO_FILE" ``` ```bash local tmp_file="${TODO_FILE}.tmp.$$" grep -vF -- "$found_line" "$TODO_FILE" > "$tmp_file" && mv "$tmp_file" "$TODO_FILE" ``` ### Technical Analysis The temporary filename is derived from the destination path and the process ID: ```bash "${TODO_FILE}.tmp.$$" ``` Process IDs are predictable, and shell output redirection does not create the file exclusively or reject symbolic links. If the directory containing `TODO_FILE` is writable by another local user, that user can pre-create the predicted temporary path as a symbolic link. When the script performs: ```bash command > "$tmp_file" ``` the shell follows the symbolic link and truncates or overwrites its target with the privileges of the user running the script. The subsequent `mv` does not prevent the initial write from occurring. Using a PID suffix reduces accidental collisions but does not provide secure temporary-file creation. The script also has no cleanup trap, restrictive temporary-file mode, or verification that the temporary path is a newly created regular file. ### Attack Path 1. The victim configures `TODO_FILE` in a directory writable by an attacker, such as a shared workspace. 2. The attacker predicts or observes the PID of an upcoming `todo.sh` process. 3. The attacke ...[truncated 1128 chars]- Remediation
View remediation
"$tmp_file"; then chmod --reference="$TODO_FILE" "$tmp_file" 2>/dev/null || chmod 600 "$tmp_file" mv -f -- "$tmp_file" "$TODO_FILE" else rm -f -- "$tmp_file" return 1 fi ``` 7. Apply the secure helper consistently to every rewrite at lines 100, 139, 169, 176, and 208. ]]>