T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:42- Finding
Predictable Shared Temporary Paths Allow Symlink-Based File Overwrite
- Content
View full analysis
/dev/null || true find cascadia_extract -name "CascadiaCode*.woff2" -not -path "*/static/*" | head -1 | xargs -I{} cp {} "$FONT_DIR/CascadiaCode.woff2" 2>/dev/null || true find cascadia_extract -name "CascadiaCode-Regular.ttf" | head -1 | xargs -I{} cp {} "$FONT_DIR/CascadiaCode.ttf" 2>/dev/null || true rm -rf cascadia.zip cascadia_extract cd "$SCRIPT_DIR" ``` ### Technical Analysis The setup script uses the fixed, globally predictable paths `/tmp/cascadia.zip` and `/tmp/cascadia_extract`. These paths are not created through a secure primitive such as `mktemp`, and the script does not verify that the archive path is a regular file owned by the current user. On systems where `/tmp` is shared among users, a local attacker can create `/tmp/cascadia.zip` as a symbolic link before setup begins. Because `curl -o` follows symbolic links, the downloaded archive can overwrite the link target with the privileges of the user running the setup script. The fixed extraction directory also permits local interference and collisions between concurrent setup processes. An attacker may pre-populate or manipulate that directory while extraction and subsequent `find` operations are in progress. The use of `2>/dev/null || true` suppresses extraction and copy failures, making tampering or corrupted installation state less visible. This behavior is unnecessary for the declared diagram-rendering functionality. Temporary artifacts can be handled in a private per-process directory without requiring elevated privileges or globally predictable paths. ### Attack Path 1. A loca ...[truncated 1429 chars]- Remediation
View remediation