T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/create-workdir.sh:39- Finding
Path Traversal Through Unvalidated Workdir Topic
- Content
View full analysis
"${WORKDIR}/commands.md" << EOF ``` ### Technical Analysis The `TOPIC` argument is incorporated directly into `WORKDIR`. The script checks only whether it starts with a date-like prefix, and a failed check produces a warning rather than terminating execution. It does not reject path separators, `..` components, or other traversal syntax. Shell quoting prevents command injection but does not prevent filesystem path traversal. A value containing traversal components can cause the normalized path to leave `${HOME}/.ssh-workdir/${HOSTNAME}`. The script then creates directories and truncates `commands.md` and `summary.md` at the resulting location. The hostname validation is appropriately restrictive, but it does not compensate for the unrestricted topic component. ### Attack Path 1. An attacker obtains the ability to influence arguments passed to `create-workdir.sh`. 2. The attacker supplies a topic containing traversal components, such as a date-prefixed value followed by `/../../`. 3. The format check accepts the date prefix or merely emits a warning. 4. `mkdir -p` resolves the traversal and creates the resulting directory outside the intended host workdir. 5. The here- ...[truncated 743 chars]- Remediation
View remediation
&2 exit 1 fi ``` - Explicitly reject `/`, `\`, `..`, control characters, and empty components. - Canonicalize the base and destination with `realpath` and verify that the destination remains below the canonical base directory. - Use `mkdir --` and other utilities with `--` before attacker-influenced operands. - Add automated tests covering absolute paths, traversal components, repeated separators, and control characters. ]]>