T09 · Insecure Skill Coding Practices
- Location
launch.sh:4- Finding
Unvalidated and Unquoted Project Path Input
- Content
View full analysis
Vulnerability Details
File Location:
launch.sh, lines 4–9
Vulnerability Type: Unvalidated path input, shell word splitting, and pathname expansion
Risk Level: MediumVulnerable Code
bash NAME="${1:-mystartup}" echo "🚀 Launching $NAME..." echo "📦 Creating project structure..." mkdir -p $NAME/{frontend,backend,database,docker}Technical Analysis
The first command-line argument is accepted as a project path without validation and subsequently expanded without quotation in the
mkdircommand.Because
$NAMEis unquoted, Bash applies word splitting and pathname expansion to its value. Input containing whitespace or wildcard characters can therefore produce multiple path arguments. The script also permits absolute paths and..traversal components, allowing directory creation outside the intended working directory.The command does not use the conventional
--end-of-options separator. Option-like input may consequently be interpreted bymkdirrather than strictly as a path, depending on the resulting expansion.This is not direct arbitrary command execution: shell metacharacters introduced through ordinary parameter expansion are not reparsed as shell syntax. The confirmed issue is uncontrolled filesystem path selection and expansion.
Attack Path
- An attacker or untrusted automation source controls the first argument supplied to
launch.sh. - The attacker supplies an absolute path, traversal sequence, whitespace-containing value, or glob pattern.
- The script assigns that value to
NAMEwithout checking its syntax or destination. - Bash performs word splitting and pathname expansion when evaluating the unquoted
$NAME. mkdir -pcreatesfrontend,backend,database, anddockerdirectory trees at one or more unintended locations where the invoking user has write permission.
For example, a traversal-based argument can direct creation outside the curre ...[truncated 736 chars]
- An attacker or untrusted automation source controls the first argument supplied to
- Remediation
View remediation
Remediation Suggestions
- Validate the project name against a strict allowlist and reject empty values, absolute paths, path separators, and traversal components.
- Quote all variable expansions used as filesystem paths.
- Add
--before path operands to terminate option processing. - Resolve and verify the destination against an explicitly permitted base directory when callers are allowed to provide nested paths.
- Exit with a clear error when validation fails.
Example hardened implementation:
bash #!/bin/bash set -euo pipefail NAME="${1:-mystartup}" if [[ ! "$NAME" =~ ^[A-Za-z0-9._-]+$ ]] || [[ "$NAME" == "." || "$NAME" == ".." ]]; then printf 'Error: invalid project name\n' >&2 exit 1 fi echo "🚀 Launching $NAME..." echo "📦 Creating project structure..." mkdir -p -- "$NAME"/{frontend,backend,database,docker}If nested destinations are a required feature, canonicalize the destination and verify that it remains beneath a trusted base directory before creating anything.