T09 · Insecure Skill Coding Practices
- Location
scripts/xiaomi-weather.sh:48- Finding
Predictable Shared Temporary File Permits Symlink Overwrite and Cache Poisoning
- Content
View full analysis
Vulnerability Details
File Location:
scripts/xiaomi-weather.sh, lines 48–57
Vulnerability Type: Unsafe temporary-file handling
Risk Level: MediumVulnerable Code
bash lookup_city() { local name="$1" local code="${CITIES[$name]:-}" [ -n "$code" ] && { echo "$code"; return 0; } # 尝试按名称模糊匹配远程库（需要 curl 联网） local db="/tmp/xiaomi_weather_cities.tsv" if [ ! -f "$db" ]; then curl -fsSL --max-time 15 \ "https://raw.githubusercontent.com/huanghui0906/API/master/xiaomi_weather.db" \ -o "$db" 2>/dev/null || return 1 fi # 数据库格式含 city_name / city_num，做一次简单 grepTechnical Analysis
The script stores remotely retrieved data at the fixed, globally predictable path
/tmp/xiaomi_weather_cities.tsv. It neither creates this file securely nor verifies its type, owner, permissions, or integrity before trusting it.The
[ ! -f "$db" ]check and subsequentcurl -o "$db"operation are also separate filesystem operations, creating a time-of-check-to-time-of-use race. An attacker with access to the shared temporary directory can manipulate the path between those operations.Two practical exploitation modes exist:
- Symlink-based file overwrite: An attacker places or races a symbolic link at the predictable path. When
curlwrites its response, the target file may be overwritten with the privileges of the user running the Skill. - City-database poisoning: An attacker creates a regular file at that path before execution. Because the script only checks whether it is a regular file, it accepts attacker-controlled contents and extracts a nine-digit location code from them.
The downloaded resource additionally follows the mutable
masterbranch and is not authenticated with a pinned commit or checksum. HTTPS protects data in transit but does not guarantee that the repository content remains identical to the version reviewed.Attack Path
**Symlink over ...[truncated 1708 chars]
- Symlink-based file overwrite: An attacker places or races a symbolic link at the predictable path. When
- Remediation
View remediation
Remediation Suggestions
- Prefer the bundled
references/cities.tsvand resolve its path relative to the installed script instead of using a shared downloaded cache. - If runtime downloading is required, create a private temporary directory and file with
mktemp -dandmktemp, under a restrictiveumasksuch as077. - Register a cleanup trap so temporary data is removed on normal exit and interruption.
- Download into a newly created temporary file, validate its format and expected ownership, and move it atomically into a user-private cache directory.
- Store persistent cache data under an account-specific cache directory such as
${XDG_CACHE_HOME:-"$HOME/.cache"}/xiaomi-weather, with directory permissions set to0700. - Reject symbolic links and files not owned by the invoking user. Where supported, use no-follow semantics when opening files.
- Pin the remote database to an immutable commit and verify a maintained cryptographic checksum or signature before use.
- Do not run the Skill as root or another privileged account.
A safer temporary-download pattern would be:
bash local tmpdir db umask 077 tmpdir=$(mktemp -d) || return 1 trap 'rm -rf -- "$tmpdir"' RETURN db="$tmpdir/cities.tsv" curl -fsSL --max-time 15 \ "https://raw.githubusercontent.com/huanghui0906/API/<PINNED_COMMIT>/xiaomi_weather.db" \ -o "$db" || return 1 # Verify the expected checksum and validate the file format before parsing.- Prefer the bundled