T09 · Insecure Skill Coding Practices
Note
- Location
scripts/script.sh:31- Finding
Unsanitized Arguments Persisted in a Plaintext History Log
- Content
View full analysis
> "$DATA_DIR/history.log"; } cmd_init() { echo " Project initialized in $(pwd)" _log "init" "${1:-}" } cmd_check() { echo " Running lint + type check + tests..." _log "check" "${1:-}" } cmd_build() { echo " Building..." _log "build" "${1:-}" } cmd_test() { echo " Running test suite..." _log "test" "${1:-}" } cmd_deploy() { echo " Deploy: build -> test -> stage -> prod" _log "deploy" "${1:-}" } cmd_config() { echo " Config: $DATA_DIR/config.json" _log "config" "${1:-}" } cmd_status() { echo " Status: checking project health..." _log "status" "${1:-}" } cmd_template() { echo " Template for: $1" _log "template" "${1:-}" } cmd_docs() { echo " Generating docs..." _log "docs" "${1:-}" } cmd_clean() { echo " Cleaned build artifacts" _log "clean" "${1:-}" } ``` ### Technical Analysis The `_log` function writes the first user-supplied command argument directly to `$DATA_DIR/history.log` without redaction, validation, or encoding. Consequently, credentials, tokens, private paths, or other sensitive values passed as command arguments may be retained indefinitely in plaintext. The input is also allowed to contain newline and control characters. A crafted argument can therefore create forged history records or alter the visual interpretation of subsequent log content. Although shell metacharacters in the argument are not evaluated as commands at this sink because the expansion is quoted, the absence of record-safe encoding compromises the integrity of the log. The script creates `$DATA_DIR` with `mkdir -p` but does not establish a restrictive `umask` or explicitly set permissions on the directory and history file. ...[truncated 1706 chars]- Remediation
View remediation
> "$DATA_DIR/history.log" ``` 5. Establish restrictive permissions before creating storage: ```bash umask 077 mkdir -p -- "$DATA_DIR" touch -- "$DATA_DIR/history.log" chmod 700 -- "$DATA_DIR" chmod 600 -- "$DATA_DIR/history.log" ``` 6. Validate that `CLOUD_SDK_DIR` points to an expected, user-controlled location and handle pre-existing directories or symbolic links according to the application's trust model. 7. Define a retention or rotation policy so historical data is not stored indefinitely. ]]>