T09 · Insecure Skill Coding Practices
Error
- Location
scripts/stitch.mjs:83- Finding
Unvalidated Project IDs Permit Filesystem Path Traversal and Out-of-Scope Writes
- Content
View full analysis
.'); } ``` The unvalidated value is inserted directly into the alias-registry path: ```js function namesFilePath(projectId) { return join(STATE_DIR, projectId, 'names.json'); } ``` The resulting path is then created and written: ```js export async function saveNames(projectId, data) { const fp = namesFilePath(projectId); const dir = dirname(fp); await mkdir(dir, { recursive: true }); // Atomic write: temp file → rename const tmp = fp + '.' + randomBytes(4).toString('hex') + '.tmp'; await writeFile(tmp, JSON.stringify(data, null, 2) + '\n'); await rename(tmp, fp); } ``` The same issue affects event-log paths: ```js function eventsFilePath(projectId) { return join(STATE_DIR, projectId, 'events.jsonl'); } ``` ```js export async function appendEvent(projectId, event) { const fp = eventsFilePath(projectId); const dir = dirname(fp); await mkdir(dir, { recursive: true }); const full = { v: SCHEMA_VERSION, id: makeEventId(), ts: new Date().toISOString(), projectId, ...event, }; await appendFile(fp, JSON.stringify(full) + '\n'); return full; } ``` ### Technical Analysis `--project` is treated as both an API identifier and a filesystem path component. No format validation rejects path separators or `..` components, and no containment check verifies that the resolved destination remains beneath `state/projects/`. Consequen ...[truncated 2045 chars]- Remediation
View remediation