T09 · Insecure Skill Coding Practices
Warning
- Location
bin/persistent-code-terminal-lib.sh:8- Finding
Predictable tmux Session Names Can Cause Cross-Project Command Execution
- Content
View full analysis
/dev/null; then echo "Using existing session: $SESSION" pct_state_update_start "$SESSION" exit 0 fi tmux new-session -d -s "$SESSION" -c "$(pwd)" ``` ### Technical Analysis Session identity is derived only from the normalized basename of the current project directory. The canonical project path is not incorporated into the name. Consequently, distinct paths such as: ```text /home/user/customer-a/api /home/user/customer-b/api ``` both resolve to: ```text api-code-session ``` Normalization also creates additional collisions. For example, `project_a` and `project-a` can normalize to the same session name. When a matching session already exists, `persistent-code-terminal-start.sh` reuses it without verifying that the session's pane working directory corresponds to the current canonical project directory. Subsequent generic commands sent through `persistent-code-terminal-send.sh` execute in the reused pane's shell context. The state file can meanwhile identify the current directory as the project, creating a misleading record of where the command actually ran. The Codex wrapper includes an explicit `--cd` argument by default, which reduces this issue for default Codex invocations. It does not protect arbitrary commands sent through `persistent-code-terminal-send.sh`, and the protection can also be removed through the document ...[truncated 1539 chars]- Remediation
View remediation