T09 · Insecure Skill Coding Practices
Warning
- Location
sync.sh:182- Finding
Unvalidated Configuration Paths Permit Repository Read and Workspace Write Escapes
- Content
View full analysis
/dev/null || echo 0) path_count="${path_count:-0}" local i=0 while [[ $i -lt $path_count ]]; do local rel_path rel_path=$(yq eval ".projects[] | select(.name == \"$name\") | .paths[$i]" "$CONFIG") i=$((i + 1)) local src="$repo/$rel_path" ``` Additional affected destination construction: ```bash local dst="$destination/$name" ``` ```bash local dest_rel dest_rel=$(yq eval '.destination // "antigravity"' "$CONFIG") local destination destination="$WORKSPACE_DIR/$(expand_path "$dest_rel")" ``` ### Technical Analysis The script obtains `destination`, project and knowledge `name` values, and project `paths` from a YAML configuration file and concatenates them directly into filesystem paths. It does not reject absolute values, `..` traversal components, or symlink-based escapes, and it does not canonicalize the resulting paths before using `mkdir` and `rsync`. Consequently: - A project path such as `../../outside.md` can resolve outside the configured repository and be copied if the resulting source is an existing Markdown file. - A project or knowledge name containing traversal components can cause the destination to escape its intended project directory. - A traversal value in `destination` can resolve outside the OpenClaw workspace. - Existing user-writable files at a resolved destination may be overwritten by `rsync`. Shell quoting prevents ordinary command injection through these values, but it does not prevent filesystem traversal. Exploitation requires control over, or modification of, the YAML configuration used by the script. ...[truncated 1597 chars]- Remediation
View remediation