T09 · Insecure Skill Coding Practices
Warning
- Location
- launch.sh:4
- Finding
- Unvalidated and Unquoted Project Path Input## Vulnerability Details **File Location**: `launch.sh`, lines 4–9 **Vulnerability Type**: Unvalidated path input, shell word splitting, and pathname expansion **Risk Level**: Medium ### Vulnerable Code ```bash NAME="${1:-mystartup}" echo "🚀 Launching $NAME..." echo "📦 Creating project structure..." mkdir -p $NAME/{frontend,backend,database,docker} ``` ### Technical Analysis The first command-line argument is accepted as a project path without validation and subsequently expanded without quotation in the `mkdir` command. Because `$NAME` is unquoted, Bash applies word splitting and pathname expansion to its value. Input containing whitespace or wildcard characters can therefore produce multiple path arguments. The script also permits absolute paths and `..` traversal components, allowing directory creation outside the intended working directory. The command does not use the conventional `--` end-of-options separator. Option-like input may consequently be interpreted by `mkdir` rather than strictly as a path, depending on the resulting expansion. This is not direct arbitrary command execution: shell metacharacters introduced through ordinary parameter expansion are not reparsed as shell syntax. The confirmed issue is uncontrolled filesystem path selection and expansion. ### Attack Path 1. An attacker or untrusted automation source controls the first argument supplied to `launch.sh`. 2. The attacker supplies an absolute path, traversal sequence, whitespace-containing value, or glob pattern. 3. The script assigns that value to `NAME` without checking its syntax or destination. 4. Bash performs word splitting and pathname expansion when evaluating the unquoted `$NAME`. 5. `mkdir -p` creates `frontend`, `backend`, `database`, and `docker` directory trees at one or more unintended locations where the invoking user has write permission. For example, a traversal-based argument can direct creation outside the curre ...[truncated 736 chars]
- Remediation
- ## Remediation Suggestions 1. Validate the project name against a strict allowlist and reject empty values, absolute paths, path separators, and traversal components. 2. Quote all variable expansions used as filesystem paths. 3. Add `--` before path operands to terminate option processing. 4. Resolve and verify the destination against an explicitly permitted base directory when callers are allowed to provide nested paths. 5. Exit with a clear error when validation fails. Example hardened implementation: ```bash #!/bin/bash set -euo pipefail NAME="${1:-mystartup}" if [[ ! "$NAME" =~ ^[A-Za-z0-9._-]+$ ]] || [[ "$NAME" == "." || "$NAME" == ".." ]]; then printf 'Error: invalid project name\n' >&2 exit 1 fi echo "🚀 Launching $NAME..." echo "📦 Creating project structure..." mkdir -p -- "$NAME"/{frontend,backend,database,docker} ``` If nested destinations are a required feature, canonicalize the destination and verify that it remains beneath a trusted base directory before creating anything.