T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/checklist.sh:416- Finding
Path Traversal in Checklist Template Selection
- Content
View full analysis
"$temp" && mv "$temp" "${ACTIVE_DIR}/current.json" ``` ### Technical Analysis The template name is supplied through the command-line interface and concatenated directly into a filesystem path: ```bash "${TEMPLATES_DIR}/${name}.json" ``` The implementation does not reject path separators, `..` components, absolute-path constructs, or other characters outside the expected template-name format. The `[[ -f "$template_file" ]]` test only confirms that the resolved path is a regular file; it does not confirm that the file remains inside `TEMPLATES_DIR`. Consequently, a crafted template name can escape `~/.checklist/templates` and select another user-readable file whose name ends in `.json`. The selected file is copied into `~/.checklist/active/current.json` before its structure is processed by `jq`. No privilege escalation is involved: access remains limited to files readable by the operating-system account running the script. ### Attack Path 1. An attacker who can invoke the CLI creates a readable JSON file outside the template directory, or identifies an existing one. 2. The attacker supplies a traversal sequence as the template name, for example: ```bash checklist create ../../../../tmp/target ``` 3. The application constructs a path similar to: ```text ~/.checklist/templates/../../../../tmp/target.json ``` 4. The regular-file ch ...[truncated 898 chars]- Remediation
View remediation