T09 · Insecure Skill Coding Practices
Error
- Location
cli-scaffold-generator.sh:4- Finding
Unrestricted project path permits files to be overwritten outside the intended output directory
- Content
View full analysis
"$NAME/package.json" << JSON { "name": "$NAME", "version": "1.0.0", "description": "$DESCRIPTION", "main": "bin/$NAME.js", "bin": { "$NAME": "bin/$NAME.js" }, "scripts": { "test": "jest", "start": "node bin/$NAME.js" }, "keywords": ["cli", "command-line", "$FRAMEWORK"], "author": "$AUTHOR", "license": "MIT", "dependencies": { "commander": "^11.0.0", "chalk": "^4.1.2" }, "devDependencies": { "jest": "^29.0.0" } } JSON ``` ### Technical Analysis The project name is accepted directly from the first positional argument and used as a filesystem path. The script does not reject: - Absolute paths - Parent-directory components such as `..` - Directory separators - Existing output directories - Symlinks that resolve outside the expected output location Shell quoting prevents word splitting and wildcard expansion, but it does not constrain where the path resolves. The `cat >` redirection truncates an existing `package.json` at the resolved destination before writing the generated content. Consequently, the caller can direct the script to create directories and overwrite predictable files outside the current working directory. Redirections also follow symbolic links. ### Attack Path 1. An attacker influences the project name supplied to the generator. 2. The attacker supplies a traversal or absolute path, for example: ```bash ./cli-scaffold-generator.sh ../../target ``` 3. `mkdir -p` creates or reuses the attacker-selected destination. 4. The package-generation redirection opens `../../target/package.json` with truncation enabled. 5. Any existing file at that loca ...[truncated 876 chars]- Remediation
View remediation
&2 exit 1 fi ``` 2. Use a dedicated, explicit output root and construct the destination beneath it. 3. Resolve the output root and destination to canonical paths, then verify that the destination remains inside the approved root. 4. Reject absolute paths, `..` components, directory separators, and symbolic-link destinations. 5. Refuse to overwrite an existing directory or file unless the caller provides an explicit overwrite option. 6. Create output atomically where possible and use restrictive default permissions. 7. Apply the same validated destination to every generated file instead of repeatedly constructing paths from raw input. ]]>