T09 · Insecure Skill Coding Practices
Error
- Location
scripts/screenshot.sh:5- Finding
Unrestricted Screenshot Target and Output Path with Chromium Sandbox Disabled
- Content
View full analysis
[width] [height]}" OUTPUT="${2:?Output path required}" WIDTH="${3:-1400}" HEIGHT="${4:-900}" # Use a temp HTML that loads the target in an iframe after delay, # or use virtual-time-budget to let JS execute chromium --headless --disable-gpu --no-sandbox --disable-dev-shm-usage \ --window-size="${WIDTH},${HEIGHT}" \ --screenshot="$OUTPUT" \ --hide-scrollbars \ --virtual-time-budget=5000 \ "$URL" 2>/dev/null ``` ### Technical Analysis The script accepts an arbitrary URL and output path without validating either value. Chromium can consequently be directed to network locations beyond the intended local preview server, including loopback services, private-network applications, and potentially cloud instance metadata endpoints. The unrestricted output argument also allows the caller to select any path writable by the current operating-system user. Existing files at those paths may be replaced by screenshot data. Symbolic links and sensitive application paths are not rejected. Chromium is launched with `--no-sandbox`. This removes an important containment boundary and increases the impact of a browser vulnerability or malicious page loaded by the script. Although sandbox disabling is sometimes used in restricted containers, the script does not detect such an environment or limit this behavior to cases where it is necessary. The intended visual-review functionality only requires access to the generated application on a known loopback port and output into a controlled temporary directory. Arbitrary network access, arbitrary output paths, and disabling the browser sandbox exceed those minimum requirements. ### Attack Path 1. An attacker per ...[truncated 1457 chars]- Remediation
View remediation