T09 · Insecure Skill Coding Practices
Warning
- Location
- vercel-config-generator.sh:4
- Finding
- Unconditional Overwrite of Existing Vercel Configuration## Vulnerability Details **File Location**: `vercel-config-generator.sh`, lines 4–14 **Vulnerability Type**: Destructive file overwrite without confirmation or backup **Risk Level**: Medium ### Vulnerable Code ```bash cat > vercel.json << 'JSON' { "buildCommand": "npm run build", "outputDirectory": "dist", "framework": null, "functions": { "api/**/*.js": { "runtime": "nodejs18.x" } } } JSON ``` ### Technical Analysis The `>` redirection operator creates `vercel.json` or truncates it if it already exists. The script does not check for an existing configuration, request confirmation, create a backup, or write the new content atomically. Consequently, invoking the generator in an existing project silently destroys the project's current Vercel configuration and replaces it with a fixed Serverless configuration. The `TYPE` variable assigned earlier in the script is unused, so supplied deployment-mode arguments do not alter or prevent this behavior. This is an insecure coding practice because a routine generation operation can cause irreversible configuration loss and alter subsequent deployment behavior without adequately informing the operator. ### Attack Path 1. A user has a project containing a trusted `vercel.json` with application-specific routes, headers, runtime settings, or access controls. 2. The user invokes the generator according to its documented usage, potentially supplying an advertised deployment mode. 3. The shell opens the existing `vercel.json` with truncation enabled. 4. The original configuration is discarded and replaced with the hardcoded content. 5. A later Vercel deployment uses the unintended configuration, potentially omitting required deployment or security settings. Exploitation requires the script to run with write access to the project directory. No privilege escalation beyond the invoking user's filesystem permissions was identified. ### Imp ...[truncated 669 chars]
- Remediation
- ## Remediation Suggestions 1. Check whether `vercel.json` already exists and refuse to overwrite it by default. 2. Require an explicit option such as `--force` before replacing an existing file. 3. Display a clear warning and request confirmation when running interactively. 4. Preserve the original file in a timestamped backup before replacement. 5. Generate the new configuration in a securely created temporary file, validate it as JSON, and then atomically rename it into place. 6. Implement the documented type, framework, and region arguments, or reject unsupported arguments with a nonzero exit status. 7. Use strict shell settings and error handling, such as `set -euo pipefail`, so failures do not produce incomplete or misleading results.