T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/md2pdf.sh:23- Finding
Predictable Temporary Files Permit Symlink-Based File Overwrite
- Content
View full analysis
"$TYPST_STYLED" <<'TYPST_HEADER' ``` ```bash # Replace invalid #horizontalrule with proper Typst syntax cat "$TYPST_TMP" | sed 's/#horizontalrule/line(length: 100%, stroke: 0.5pt + luma(180))/g' >> "$TYPST_STYLED" # Typst: styled → PDF typst compile "$TYPST_STYLED" "$OUTPUT" --root "$INPUT_DIR" # Cleanup temp files rm -f "$TYPST_TMP" "$TYPST_STYLED" ``` ### Technical Analysis The script creates two intermediate files using deterministic names derived from the user-supplied input basename: - `.${BASENAME}.typ` - `.${BASENAME}_styled.typ` These files are created in the source file's directory without exclusive creation, symbolic-link validation, or a private temporary directory. If another user or process can write to that directory, it can predict these paths and create symbolic links at them before the script runs. Pandoc's output operation and the shell's `>` or `>>` redirections may follow such symbolic links. Consequently, the script can truncate or overwrite the symlink target using the permissions of the user running the converter. The script also lacks an `EXIT` cleanup trap. Because `set -e` terminates execution after an error, a Pandoc, Typst, or pipeline failure may leave intermediate files containing document data on disk. ### Attack Path 1. The attacker identifies a writa ...[truncated 1334 chars]- Remediation
View remediation