T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/collect.py:53- Finding
Overbroad Home-Directory Repository Reconnaissance
- Content
View full analysis
list: """ Return search directories. Strategy: scan the ENTIRE home directory. No hardcoded guessing — we find ALL repos wherever they are, including hidden directories like .qclaw, .gongfeng-copilot, etc. """ home = get_home() dirs = [home] # Start from HOME, the script will walk into all subdirs # On Windows, also scan common non-home drive letters if SYSTEM == "Windows": for drive in ["C", "D", "E", "F"]: drive_path = Path(f"{drive}:/") if drive_path.is_dir() and drive_path != home.anchor: # Don't scan entire C:/, just common dev dirs on other drives for name in ["projects", "Projects", "code", "Code", "repos", "Repos", "work", "Work", "dev", "Dev"]: candidate = drive_path / name if candidate.is_dir(): dirs.append(candidate) return dirs ``` ```python def discover_repos(search_dirs: list, exclude_dirs: set, max_depth: int) -> list: """ Walk through search directories and find ALL git repositories, including those in hidden directories (e.g. .qclaw, .gongfeng-copilot). Cross-platform, uses os.walk instead of shell commands. """ repos = [] seen = set() # Merge user-configured excludes with global excludes all_excludes = GLOBAL_EXCLUDE_DIRS | exclude_dirs for search_dir in search_dirs: search_dir = Path(search_dir) if not search_dir.is_dir(): continue base_depth = len(search_dir.parts) for root, dirs, _files in os.walk(str(search_dir)): root_path = Path(root) ...[truncated 4564 chars]- Remediation
View remediation