T09 · Insecure Skill Coding Practices
Error
- Location
workflows/remove-phase.md:21- Finding
Unvalidated Phase Input Reaches Recursive Directory Deletion
- Content
View full analysis
" exit 1 fi TARGET=$ARGUMENTS ``` ```bash grep -q "Phase ${TARGET}:" .planning/ROADMAP.md || { echo "ERROR: Phase ${TARGET} not found" exit 1 } ``` ```bash CURRENT=$(grep "Phase:" .planning/STATE.md | grep -oE "[0-9]+" | head -1) if [ "$TARGET" -le "$CURRENT" ]; then echo "ERROR: Can only remove future phases (current: $CURRENT)" exit 1 fi ``` ```bash rm -rf .planning/phases/${TARGET}-*/ ``` ### Technical Analysis The workflow copies `$ARGUMENTS` into `TARGET` without enforcing the documented integer-only phase-number format. It subsequently inserts the value into a regular expression and, more critically, into an unquoted pathname passed to `rm -rf`. Because the deletion operand is unquoted, shell word splitting and pathname expansion apply. Path traversal sequences and glob metacharacters can alter which directories match. The numeric comparison is not an adequate validator: a non-numeric operand can make `[` return an error, but the workflow does not explicitly terminate on that error. The roadmap check also treats `TARGET` as a regular expression rather than a literal phase identifier. This can permit unexpected matches. Exploitation may require control over, or a suitable existing match in, `.planning/ROADMAP.md`. ### Attack Path 1. An attacker supplies a malformed phase argument containing regular-expression, glob, whitespace, or path-traversal syntax. 2. The argument is assigned directly to `TARGET`. 3. The interpolated regular expression matches an existing or attacker-influenced roadmap entry. 4. The numeric comparison fails to provide a strict allowlist check and may not terminate execution. 5. Th ...[truncated 750 chars]- Remediation
View remediation