T09 · Insecure Skill Coding Practices
- Location
tests/smoke_test.sh:4- Finding
Predictable Temporary File Allows Symlink-Based File Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
tests/smoke_test.sh, line 4
Vulnerability Type: Insecure predictable temporary-file handling
Risk Level: MediumVulnerable Code
sh python3 scripts/apa7_quick_check.py examples/demo_references.txt >/tmp/apa7_reference_helper_smoke.txtTechnical Analysis
The smoke test redirects output to a fixed, globally predictable path in
/tmp. On multi-user systems, an attacker may create/tmp/apa7_reference_helper_smoke.txtbefore the test runs and make it a symbolic link to another file.Shell redirection opens the destination before launching Python. It ordinarily follows symbolic links and truncates the resolved target. No private temporary directory, exclusive file creation, ownership validation, or symbolic-link protection is used.
Successful exploitation requires the attacker to be able to create the predictable path before the victim runs the test. The linked target must also be writable by the victim account. Existing platform protections, such as Linux
fs.protected_symlinks, may restrict exploitation in some environments but should not be relied upon as the application's primary defense.Attack Path
- A local attacker predicts the fixed path
/tmp/apa7_reference_helper_smoke.txt. - Before the test runs, the attacker creates that path as a symbolic link to a file writable by the prospective test runner.
- The victim or CI process executes
tests/smoke_test.sh. - The shell processes the output redirection on line 4 and follows the symbolic link.
- The linked target is truncated and replaced with output from
apa7_quick_check.py. - The subsequent
grepreads through the same path, while the original target remains corrupted.
Impact Assessment
The vulnerability permits local file corruption within the permissions of the account running the smoke test. It does not independently bypass operating-system access controls or grant arbitrary code execution.
Under a normal u ...[truncated 327 chars]
- A local attacker predicts the fixed path
- Remediation
View remediation
Remediation Suggestions
Avoid creating a temporary file when it is unnecessary. Pipe the checker output directly to
grep:sh #!/usr/bin/env sh set -eu cd "$(dirname "$0")/.." if ! python3 scripts/apa7_quick_check.py examples/demo_references.txt | grep -q "Checked 3 reference"; then echo "Smoke test failed" >&2 exit 1 fi echo "apa7-reference-helper smoke test passed"If output must be retained, create a uniquely named file securely with
mktemp, quote all references to it, and remove it through a trap:sh tmp_file="$(mktemp "${TMPDIR:-/tmp}/apa7-reference-helper.XXXXXX")" trap 'rm -f "$tmp_file"' EXIT HUP INT TERM python3 scripts/apa7_quick_check.py examples/demo_references.txt >"$tmp_file" if ! grep -q "Checked 3 reference" "$tmp_file"; then echo "Smoke test failed" >&2 exit 1 fiTests running with elevated privileges should additionally use a private, permission-restricted temporary directory and avoid shared temporary paths wherever possible.