T09 · Insecure Skill Coding Practices
- Location
scripts/safe_ops.ps1:45- Finding
Arbitrary Unmatched Paths Are Approved for Relocation by Default
- Content
View full analysis
Vulnerability Details
File Location:
scripts/safe_ops.ps1, lines 45-64
Vulnerability Type: Fail-open path validation
Risk Level: Highpowershell # AppData main program directories are blocked $progPatterns = @('office6','\WPS Office\','\Kingsoft\','\JianyingPro\','\Microsoft\Office','\Adobe\','\JetBrains\') # Cache and temporary directory characteristics that are explicitly allowed $allow = @('Temp','*Cache','*cache','*-updater','pip','npm','node_modules','临时') # User-file paths that are allowed when confirmed $userPatterns = @('\Desktop','\Downloads','\Documents','桌面','下载','文档','Pictures','图片','Videos','视频','Music','音乐') foreach($pat in $imPatterns){ if($norm -like "*$pat*"){ return @{Ok=$false; Reason="Blocked chat or encrypted database path."} } } foreach($pat in $progPatterns){ if($norm -like "*$pat*"){ return @{Ok=$false; Reason="Blocked application program directory."} } } $name = Split-Path $norm -Leaf foreach($a in $allow){ if($name -like $a){ return @{Ok=$true; Reason=""} } } foreach($u in $userPatterns){ if($norm -like "*$u*"){ return @{Ok=$true; Reason="Confirmed user-file relocation."} } } # All other paths are allowed by default return @{Ok=$true; Reason=""}Technical Analysis
Test-SafeToMoveimplements a denylist rather than a strict allowlist. Although it blocks several known instant-messaging and application paths, every path that does not match those limited patterns reaches the final successful return value.Consequently, the safety check does not establish that the supplied path is a cache, temporary directory, or approved personal directory. An arbitrary directory accessible to the invoking user can be passed to
MoveToBackuporSendToRecycle. The-Confirmedswitch proves only that the operation was enabled; it does not make the selected path safe.The function also performs string-based matching before canonical path validation. It does not establish that ...[truncated 1348 chars]
- Remediation
View remediation
Remediation Suggestions
- Change the final result of
Test-SafeToMoveto a denial. - Maintain an explicit allowlist of narrowly defined cache and temporary roots.
- Resolve the path with
Resolve-Pathbefore authorization and compare the canonical path against approved roots. - Reject path traversal, device paths, alternate data streams, symbolic links, junctions, and other reparse points unless specifically supported and validated.
- Separate cache operations from personal-file relocation so each action has purpose-specific validation.
- Require a fresh, path-specific confirmation that displays the canonical source and destination.
- Add tests proving that unknown application, system, profile, and junction-backed paths are rejected.
- Change the final result of