T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/script.sh:8
- Finding
- Task Data May Be Exposed to Other Local Users<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh`, lines 8–15 **Vulnerability Type**: Insecure filesystem permissions **Risk Level**: Medium ### Vulnerable Code ```bash DATA_DIR="${TASK_PLANNER_DIR:-$HOME/.task-planner}" TASKS_FILE="$DATA_DIR/tasks.json" mkdir -p "$DATA_DIR" # Initialize tasks file if missing if [[ ! -f "$TASKS_FILE" ]]; then echo '[]' > "$TASKS_FILE" fi ``` Task data is subsequently written without explicitly restricting its permissions: ```python with open(tasks_file, 'w') as f: json.dump([], f) with open(tasks_file, "w") as f: json.dump(tasks, f, indent=2) ``` ### Technical Analysis The script creates the task storage directory and JSON file without setting restrictive permission modes or establishing a secure `umask`. Their resulting permissions therefore depend on the invoking process's environment. With a common `umask` such as `022`, the directory may be created as `0755` and the task file as `0644`. If the user's home directory or configured `TASK_PLANNER_DIR` is traversable, other local users may be able to read the file. The stored data includes task descriptions, priorities, deadlines, statuses, and creation timestamps. This behavior conflicts with the documented privacy assurance that all task information remains private on the local machine. Local storage alone does not ensure confidentiality when filesystem permissions permit access by other accounts. ### Attack Path 1. A user invokes the task planner with a permissive `umask`, such as `022`. 2. The script creates `~/.task-planner` and `tasks.json` without explicit restrictive modes. 3. The directory and file inherit permissions that may allow access by other local users. 4. A local attacker identifies the victim's task storage path. 5. If the parent directories are traversable, the attacker reads `tasks.json`. 6. The attacker obtains the victim's task descriptions, deadlines, priorities, statuses, and timestamps. ### Impact Asses ...[truncated 553 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Establish a restrictive process-level `umask` before creating or writing task data: ```bash umask 077 ``` 2. Create the storage directory with owner-only permissions and correct permissions on an existing directory: ```bash mkdir -p -m 700 "$DATA_DIR" chmod 700 "$DATA_DIR" ``` 3. Create and maintain the task file with mode `0600`: ```bash if [[ ! -f "$TASKS_FILE" ]]; then printf '%s\n' '[]' > "$TASKS_FILE" fi chmod 600 "$TASKS_FILE" ``` 4. In the embedded Python code, use atomic replacement to prevent partially written files. Create the temporary file in the same protected directory with mode `0600`, flush and synchronize it, and then replace the destination with `os.replace()`. 5. Validate the permissions and ownership of existing storage before use. Refuse to process a task file owned by another account or located in an unexpectedly permissive directory. 6. Add automated tests that execute the script under permissive `umask` values and verify that the directory remains `0700` and the task file remains `0600`. ]]>