T09 · Insecure Skill Coding Practices
Error
- Location
- chrome-extension-generator.sh:43
- Finding
- Unvalidated input permits path traversal, file overwrite, and generated extension content injection<![CDATA[ ## Vulnerability Details **File Location**: `chrome-extension-generator.sh:6-10, 43-47, 57-111, 138-170` **Vulnerability Type**: Path traversal, unsafe file overwrite, JSON injection, and HTML injection **Risk Level**: High ### Vulnerable Code ```bash NAME="${1:-}" DESCRIPTION="${2:-}" TEMPLATE="${3:-basic}" STACK="${4:-javascript}" OUTPUT_DIR="${5:-.}" ``` ```bash DIR_NAME=$(echo "$NAME" | tr '[:upper:]' '[:lower:]' | tr ' ' '-') OUTPUT_PATH="$OUTPUT_DIR/$DIR_NAME" mkdir -p "$OUTPUT_PATH" mkdir -p "$OUTPUT_PATH/_locales/en" ``` ```bash cat > "$OUTPUT_PATH/manifest.json" << MANIFEST { "manifest_version": 3, "name": "$NAME", "version": "1.0.0", "description": "$DESCRIPTION", "permissions": ["storage"], "action": { "default_popup": "popup.html", "default_icon": "icon.png" }, "background": { "service_worker": "background.js" }, "icons": { "16": "icon.png", "48": "icon.png", "128": "icon.png" } } MANIFEST ``` ```bash cat > "$OUTPUT_PATH/popup.html" << POPUP <!DOCTYPE html> <html> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>$NAME</title> <style> body { width: 300px; padding: 16px; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; } h1 { font-size: 16px; margin: 0 0 12px; } button { width: 100%; padding: 10px; background: #4285f4; color: white; border: none; border-radius: 4px; cursor: pointer; } button:hover { background: #3367d6; } </style> </head> <body> <h1>$NAME</h1> <p>$DESCRIPTION</p> <button id="actionBtn">Click Me</button> <script src="popup.js"></script> </body> </html> POPUP ``` ```bash cat > "$OUTPUT_PATH/README.md" << README # $NAME $DESCRIPTION ``` ### Technical Analysis The extension name is converted to lowercase and spaces are replaced with hyphens, but directory separators, `..` path compon ...[truncated 2677 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Restrict generated directory names** - Reject `/`, `\`, `.` and `..` path components, control characters, leading hyphens, and unsupported characters. - Convert names to a conservative slug, such as lowercase ASCII letters, digits, and hyphens. - Reject an empty slug after normalization. 2. **Enforce output-root containment** - Canonicalize the output root and proposed destination. - Verify that the canonical destination remains beneath the canonical output root before creating or writing any files. - Do not rely only on string prefix checks; account for path-component boundaries and symbolic links. 3. **Prevent unintended overwrites** - Refuse to proceed if the destination already exists unless the user explicitly supplies a documented overwrite option. - Use no-clobber creation semantics where practical. - Validate that destination files are regular files and do not follow attacker-controlled symbolic links. 4. **Generate JSON with a real serializer** - Use a JSON-aware tool or language library instead of interpolating values into a heredoc. - Ensure quotes, backslashes, newlines, and control characters are correctly escaped. 5. **Encode HTML text** - HTML-escape the extension name and description before placing them into text contexts such as `<title>`, `<h1>`, and `<p>`. - Keep user-controlled values out of raw markup and script contexts. 6. **Add negative security tests** - Test names containing `../`, absolute paths, slashes, quotes, newlines, JSON fragments, and HTML tags. - Verify that existing files are never replaced without explicit confirmation. - Verify that generated manifests remain valid JSON for all accepted input. ]]>