T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/safe_ops.ps1:45
- Finding
- Arbitrary Unmatched Paths Are Approved for Relocation by Default## Vulnerability Details **File Location**: `scripts/safe_ops.ps1`, lines 45-64 **Vulnerability Type**: Fail-open path validation **Risk Level**: High ```powershell # AppData main program directories are blocked $progPatterns = @('office6','\WPS Office\','\Kingsoft\','\JianyingPro\','\Microsoft\Office','\Adobe\','\JetBrains\') # Cache and temporary directory characteristics that are explicitly allowed $allow = @('Temp','*Cache','*cache','*-updater','pip','npm','node_modules','临时') # User-file paths that are allowed when confirmed $userPatterns = @('\Desktop','\Downloads','\Documents','桌面','下载','文档','Pictures','图片','Videos','视频','Music','音乐') foreach($pat in $imPatterns){ if($norm -like "*$pat*"){ return @{Ok=$false; Reason="Blocked chat or encrypted database path."} } } foreach($pat in $progPatterns){ if($norm -like "*$pat*"){ return @{Ok=$false; Reason="Blocked application program directory."} } } $name = Split-Path $norm -Leaf foreach($a in $allow){ if($name -like $a){ return @{Ok=$true; Reason=""} } } foreach($u in $userPatterns){ if($norm -like "*$u*"){ return @{Ok=$true; Reason="Confirmed user-file relocation."} } } # All other paths are allowed by default return @{Ok=$true; Reason=""} ``` ### Technical Analysis `Test-SafeToMove` implements a denylist rather than a strict allowlist. Although it blocks several known instant-messaging and application paths, every path that does not match those limited patterns reaches the final successful return value. Consequently, the safety check does not establish that the supplied path is a cache, temporary directory, or approved personal directory. An arbitrary directory accessible to the invoking user can be passed to `MoveToBackup` or `SendToRecycle`. The `-Confirmed` switch proves only that the operation was enabled; it does not make the selected path safe. The function also performs string-based matching before canonical path validation. It does not establish that ...[truncated 1348 chars]
- Remediation
- ## Remediation Suggestions - Change the final result of `Test-SafeToMove` to a denial. - Maintain an explicit allowlist of narrowly defined cache and temporary roots. - Resolve the path with `Resolve-Path` before authorization and compare the canonical path against approved roots. - Reject path traversal, device paths, alternate data streams, symbolic links, junctions, and other reparse points unless specifically supported and validated. - Separate cache operations from personal-file relocation so each action has purpose-specific validation. - Require a fresh, path-specific confirmation that displays the canonical source and destination. - Add tests proving that unknown application, system, profile, and junction-backed paths are rejected.