T09 · Insecure Skill Coding Practices
Error
- Location
- page-generator/scripts/tpf-cli.py:192
- Finding
- GitHub Pages deployment destructively modifies the active Git working tree<![CDATA[ ## Vulnerability Details **File Location**: `page-generator/scripts/tpf-cli.py:192-265` **Vulnerability Type**: Unsafe repository modification and unintended publication **Risk Level**: High ### Vulnerable Code ```python # Check if gh-pages branch exists result = subprocess.run( ["git", "branch", "--list", "gh-pages"], cwd=project_dir, capture_output=True, text=True ) if "gh-pages" not in result.stdout: # Create orphan branch subprocess.run( ["git", "checkout", "--orphan", "gh-pages"], cwd=project_dir, check=True ) subprocess.run( ["git", "rm", "-rf", "."], cwd=project_dir, check=True ) else: subprocess.run( ["git", "checkout", "gh-pages"], cwd=project_dir, check=True ) # Copy dist contents to root for item in dist_dir.iterdir(): if item.is_file(): shutil.copy(item, project_dir / item.name) # Commit and push subprocess.run(["git", "add", "."], cwd=project_dir, check=True) subprocess.run( ["git", "commit", "-m", "Deploy to GitHub Pages"], cwd=project_dir, check=True, capture_output=True ) subprocess.run( ["git", "push", "origin", "gh-pages"], cwd=project_dir, check=True ) # Get repo URL result = subprocess.run( ["git", "remote", "get-url", "origin"], cwd=project_dir, capture_output=True, text=True, check=True ) repo_url = result.stdout.strip() finally: # Switch back to main branch subprocess.run( ["git", "checkout", "-"], cwd=project_dir, capture_output=True ) ``` ### Technical Analysis The deployment comments describe a temporary worktree, but the implementation does not create one. It checks out the `gh-pages` branch directly in the user's active repository. When the branch does not exist, it creates an orphan branch and executes `git rm -rf .`, removing all tracked content from the active working tree and index. The script then cop ...[truncated 1918 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Deploy from an isolated temporary worktree: ```bash git worktree add --detach <temporary-directory> ``` Alternatively, use a dedicated temporary Git repository containing only the generated artifacts. 2. Never run `git rm -rf .` in the primary working tree. 3. Check repository status before deployment: ```bash git status --porcelain ``` Refuse deployment when local changes exist unless the user explicitly selects a safe override. 4. Copy and stage only allowlisted artifacts, such as: - `index.html` - `trip-data.json` - Explicitly required static assets 5. Avoid `git add .`; pass exact artifact paths to `git add`. 6. Display the resolved remote URL, branch, and files to be published, then require explicit confirmation before pushing. 7. Use `check=True` for restoration operations and report restoration failures prominently. 8. Add a dry-run mode that reports all Git and filesystem changes without modifying the repository. 9. Preserve and clean up temporary worktrees in a guarded `finally` block without altering the caller's checked-out branch. ]]>