T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check_session_state.sh:21- Finding
Predictable Temporary File Allows Symlink-Based File Clobbering
- Content
View full analysis
/dev/null || echo "0") if [ "$line_count" -gt "$MAX_LINES" ]; then echo "⚠️ SESSION-STATE.md has $line_count lines (>$MAX_LINES), truncating to last $KEEP_LINES lines..." local truncated_count=$((line_count - KEEP_LINES)) echo " (Truncating $truncated_count lines of history)" tail -"$KEEP_LINES" "$SESSION_STATE" > "${SESSION_STATE}.tmp" { echo "---" echo "## 📋 历史截断通知" echo "" echo "**时间**: $(date -Iseconds)" echo "**原因**: 文件超过 ${MAX_LINES} 行（当前 ${line_count} 行）" echo "**操作**: 保留最近 ${KEEP_LINES} 行，截断 ${truncated_count} 行历史" echo "**建议**: 重要内容已归档至 SESSION-STATE-history.md" echo "" echo "---" echo "" cat "${SESSION_STATE}.tmp" } > "$SESSION_STATE" rm -f "${SESSION_STATE}.tmp" echo "✅ Truncation complete. New size: $(wc -l < "$SESSION_STATE") lines" fi } ``` ### Technical Analysis The script uses the fixed path `${SESSION_STATE}.tmp` as a temporary file. Shell output redirection creates or truncates that path without exclusive creation, ownership verification, or symlink rejection. If the script is executed with elevated privileges and an attacker can create entries in the workspace directory, the attacker can pre-create `SESSION-STATE.md.tmp` as a symbolic link. The redirection used by `tail` will follow that link and truncate or overwrite the linked target with the last 1,000 lines of the session-state file. The script hardcodes the workspace under `/root/.openclaw/workspace`, increasing the potential ...[truncated 1197 chars]- Remediation
View remediation
"$tmp_file" final_file=$(mktemp "${SESSION_STATE}.new.XXXXXX") trap 'rm -f -- "$tmp_file" "$final_file"' EXIT { printf '%s\n' "---" printf '%s\n' "## History truncation notice" printf '%s\n\n' "**Time**: $(date -Iseconds)" cat -- "$tmp_file" } > "$final_file" mv -f -- "$final_file" "$SESSION_STATE" rm -f -- "$tmp_file" trap - EXIT ``` ]]>