T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/yt2gdrive.sh:42- Finding
Dry-run mode performs real downloads and destructive local cleanup
- Content
View full analysis
Vulnerability Details
File Location:
scripts/yt2gdrive.sh, lines 42–46, 99–116, 145–149, and 154–164
Vulnerability Type: Dry-run safety violation and unintended file deletion
Risk Level: MediumVulnerable Code
bash DRY_RUN="" KEEP_LOCAL="" for arg in "$@"; do case $arg in --dry-run) DRY_RUN="--dry-run"; echo "⚡ DRY RUN 模式，不实际下载/上传" ;; --keep-local) KEEP_LOCAL=1 ;; esac donebash yt-dlp \ --download-archive "$ARCHIVE_FILE" \ --dateafter "$date_min" \ --match-filter "duration < $MAX_DURATION" \ --break-on-reject \ --playlist-end "$MAX_DOWNLOADS" \ "${media_args[@]}" \ --no-overwrites \ --ignore-errors \ --no-warnings \ --progress \ -o "${LOCAL_DIR}/%(uploader)s/%(upload_date>%Y%m%d)s - %(title).120s.%(ext)s" \ "$url" \ >> "$LOG_FILE" 2>&1 || log "⚠️ 频道 $channel_name 部分下载失败（已记录）"bash rclone copy "$LOCAL_DIR/" "${REMOTE_NAME}:${REMOTE_PATH}/" \ --fast-list \ --transfers=4 \ --checkers=8 \ --bwlimit="$BWLIMIT" \ --log-file="$LOG_FILE" \ --log-level=INFO \ $DRY_RUNbash cleanup_local() { if [[ -n "$KEEP_LOCAL" ]]; then log "📦 本地文件保留（--keep-local）" return 0 fi log "🧹 清理本地 ${CLEANUP_DAYS} 天前的文件..." find "$LOCAL_DIR" -type f -mtime "+${CLEANUP_DAYS}" -delete 2>/dev/null || true find "$LOCAL_DIR" -type d -empty -delete 2>/dev/null || true log "🧹 清理完成" }Technical Analysis
The
--dry-runoption is stored inDRY_RUNand supplied only torclone copy. Theyt-dlpinvocation receives no simulation option, so it performs actual network requests, media downloads, conversion, archive updates, and local writes.The script subsequently invokes
cleanup_localregardless of dry-run status. Unless--keep-localis also supplied, the cle ...[truncated 1514 chars]- Remediation
View remediation
Remediation Suggestions
- Implement dry-run consistently across every mutating stage:
- Pass
--simulatetoyt-dlp, or skip the download function entirely. - Do not update the download archive in preview mode.
- Return before
cleanup_localwhen dry-run is enabled.
- Pass
- Represent optional command arguments with an array rather than an unquoted scalar:
bash dry_run_args=() if [[ "$DRY_RUN" == "1" ]]; then dry_run_args=(--dry-run) fi - Add an explicit guard to cleanup:
bash cleanup_local() { if [[ "$DRY_RUN" == "1" ]]; then log "Dry run: skipping local cleanup" return 0 fi # Existing cleanup logic } - Validate
LOCAL_DIRbefore deletion:- Reject empty values,
/,$HOME, and other unexpectedly broad paths. - Resolve the canonical path and require it to match an application-specific staging directory or an explicitly approved location.
- Reject empty values,
- Consider requiring explicit confirmation before cleanup when
LOCAL_DIRdiffers from the default. - Add automated tests confirming that dry-run mode creates, modifies, uploads, and deletes no files.
- Implement dry-run consistently across every mutating stage: