T09 · Insecure Skill Coding Practices
Error
- Location
- cli-scaffold-generator.sh:4
- Finding
- Unrestricted project path permits files to be overwritten outside the intended output directory<![CDATA[ ## Vulnerability Details **File Location**: `cli-scaffold-generator.sh`, lines 4 and 22-45 **Vulnerability Type**: Path traversal and arbitrary file overwrite **Risk Level**: High ### Vulnerable Code ```bash NAME="${1:-my-cli}" ``` ```bash # Create directory structure mkdir -p "$NAME"/{bin,lib,test} # Generate package.json cat > "$NAME/package.json" << JSON { "name": "$NAME", "version": "1.0.0", "description": "$DESCRIPTION", "main": "bin/$NAME.js", "bin": { "$NAME": "bin/$NAME.js" }, "scripts": { "test": "jest", "start": "node bin/$NAME.js" }, "keywords": ["cli", "command-line", "$FRAMEWORK"], "author": "$AUTHOR", "license": "MIT", "dependencies": { "commander": "^11.0.0", "chalk": "^4.1.2" }, "devDependencies": { "jest": "^29.0.0" } } JSON ``` ### Technical Analysis The project name is accepted directly from the first positional argument and used as a filesystem path. The script does not reject: - Absolute paths - Parent-directory components such as `..` - Directory separators - Existing output directories - Symlinks that resolve outside the expected output location Shell quoting prevents word splitting and wildcard expansion, but it does not constrain where the path resolves. The `cat >` redirection truncates an existing `package.json` at the resolved destination before writing the generated content. Consequently, the caller can direct the script to create directories and overwrite predictable files outside the current working directory. Redirections also follow symbolic links. ### Attack Path 1. An attacker influences the project name supplied to the generator. 2. The attacker supplies a traversal or absolute path, for example: ```bash ./cli-scaffold-generator.sh ../../target ``` 3. `mkdir -p` creates or reuses the attacker-selected destination. 4. The package-generation redirection opens `../../target/package.json` with truncation enabled. 5. Any existing file at that loca ...[truncated 876 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate the project name as an identifier rather than accepting it as a path: ```bash if [[ ! "$NAME" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then printf 'Error: invalid project name\n' >&2 exit 1 fi ``` 2. Use a dedicated, explicit output root and construct the destination beneath it. 3. Resolve the output root and destination to canonical paths, then verify that the destination remains inside the approved root. 4. Reject absolute paths, `..` components, directory separators, and symbolic-link destinations. 5. Refuse to overwrite an existing directory or file unless the caller provides an explicit overwrite option. 6. Create output atomically where possible and use restrictive default permissions. 7. Apply the same validated destination to every generated file instead of repeatedly constructing paths from raw input. ]]>