T09 · Insecure Skill Coding Practices
Error
- Location
- references/build-questions.md:13
- Finding
- Destructive cleanup commands can delete files outside the intended project<![CDATA[ ## Vulnerability Details **File Location**: - `references/build-questions.md:13-26` - `references/cpp-unittest.md:25-39` - `references/golang-unittest.md:33-47` **Vulnerability Type**: Unsafe recursive deletion and insufficient path validation **Risk Level**: High The same mandatory cleanup procedure appears in all three locations: ```bash rm -rf build* rm -rf log/ rm -rf install/ rm -rf kwbase/.buildinfo rm -rf kwbase/bin rm -rf kwbase/build/defs.mk kwbase/build/defs.mk.sig rm -rf qa/TEST_integration rm -rf kwbase/ui/yarn.installed rm -rf ${GOPATH}/native rm -rf kwdbts2/roachpb/*.cc kwdbts2/roachpb/*.h cd kwbase && GOPATH=${GOPATH} make clean -f Makefile_ent ``` ### Technical Analysis The cleanup procedure combines `rm -rf` with relative paths, a broad `build*` wildcard, and an unquoted environment-derived path. It does not include an atomic operation that enters the expected project directory and verifies that directory before deletion. Consequently: - If the agent executes the commands from an incorrect working directory, `build*`, `log/`, and `install/` can refer to unrelated files. - The `build*` expression deletes every matching entry rather than one exact build directory. - If `GOPATH` is empty, `${GOPATH}/native` expands to `/native`. - If `GOPATH` contains whitespace or shell glob characters, the unquoted expansion can produce multiple or unintended deletion arguments. - Generated C++ files under `kwdbts2/roachpb` are deleted by wildcard without verifying that the resolved directory belongs to the validated project. Although the documentation separately requires source and GOPATH validation, the destructive command block itself does not enforce those invariants. An agent can therefore execute it from stale or incorrect shell state. ### Attack Path 1. A build or unit-test request causes the agent to apply the mandatory cleanup procedure. 2. The shell is not currently inside the validated KaiwuDB source directory, or `GOPATH` is empty or ...[truncated 822 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Resolve both the source directory and `GOPATH` to canonical absolute paths before performing cleanup. 2. Reject empty, root-level, nonexistent, or unexpected paths: ```bash : "${GOPATH:?GOPATH must be set}" project_root="$(realpath -- "$SOURCE_DIR")" gopath_root="$(realpath -- "$GOPATH")" case "$project_root" in "$gopath_root"/src/gitee.com/kwbasedb/*) ;; *) printf 'Invalid project directory\n' >&2; exit 1 ;; esac ``` 3. Enter the validated project directory and terminate if that operation fails: ```bash cd -- "$project_root" || exit 1 ``` 4. Replace `build*` with an exact allowlist such as `"$project_root/build"`. 5. Quote every path expansion, especially `"$GOPATH/native"`. 6. Before deletion, verify that each canonical target is a descendant of an approved root and is not `/`, the user's home directory, or the GOPATH root itself. 7. Prefer CMake-native cleanup where possible, such as `cmake --build "$build_dir" --target clean`. 8. Require explicit user confirmation before deleting directories outside the project root, including `"$GOPATH/native"`. ]]>