T09 · Insecure Skill Coding Practices
Error
- Location
dream-tools.sh:92- Finding
Unrestricted File Replacement Through the Atomic Write Command
- Content
View full analysis
" [[ ! -f "$tmpfile" ]] && die "tmp 文件不存在：$tmpfile" # 若目标是 MEMORY.md，检查字符数上限 if [[ "$(realpath "$target" 2>/dev/null)" == "$(realpath "$MEMORY_MD" 2>/dev/null)" ]] || \ [[ "$target" == *"MEMORY.md" ]]; then local size size=$(wc -c < "$tmpfile" | tr -d ' ') if [[ $size -gt $MEMORY_HARD_LIMIT ]]; then die "写入中止：tmp 文件大小 ${size} 字符，超过硬上限 ${MEMORY_HARD_LIMIT}。请先压缩内容。" fi log "MEMORY.md 写入校验通过：${size}/${MEMORY_HARD_LIMIT} 字符" fi ensure_dir "$target" # mv 在同一文件系统上是原子操作 mv "$tmpfile" "$target" log "原子写入完成：$target" } ``` ### Technical Analysis The `--atomic-write` command accepts both the source and destination paths from command-line arguments. It validates only that the source exists. It does not constrain the destination to `MEMORY_MD`, `DREAM_VAULT_PATH`, or `OPENCLAW_WORKSPACE`. The `MEMORY.md` check imposes a size limit but is not an authorization check. For every other destination, the function creates the destination's parent directory and moves the supplied file into place without validating the canonical destination path. This contradicts the README claim that all file operations are strictly scoped to the Dream vault and OpenClaw workspace. Quoting the variables prevents shell metacharacter injection, but it does not prevent arbitrary path selection, traversal, symlink-based redirection, or replacement of unrelated files. ### Attack Path 1. An attacker or untrusted agent instruction creates a file containing attacker-selected data. 2. The attacker invokes the helper with that file and an arbitrary user-writable target: `` ...[truncated 1091 chars]- Remediation
View remediation