search

awslabs / automated-security-helper

https://awslabs.github.io/automated-security-helper/
Apache License 2.0
372 stars 44 forks source link

Mitigate potential risks of rm command #36

Closed john-aws closed 5 months ago

john-aws commented 7 months ago

The ash script contains two calls to rm of directory entries that are prefixed by shell variables:

rm -rf "${OUTPUT_DIR}"/work
rm -f "${OUTPUT_DIR}"/"${AGGREGATED_RESULTS_REPORT_FILENAME}"

While unlikely, it is not inconceivable that a bug could be introduced into the script whereby one or more of the shell variables evaluates to an empty string, thus causing rm to attempt to remove the wrong thing. The presence of the -f force flag adds additional jeopardy.

A famous variant of this problem was the Ran steam. It deleted everything on system owned by user bug where a Steam bash script ran rm -rf "$STEAMROOT/"* when $STEAMROOT was inadvertently empty. More discussion here.

Some suggestions for mitigating a mistake:

  1. set -u
  2. set -euo pipefail
  3. check the shell variables are not empty before executing the rm command
  4. so-called bash strict mode