mirror of
https://github.com/trailofbits/skills
synced 2026-06-21 14:12:00 +00:00
Paweł Płatek
870955f1af
* init c review * lsp * agents -> prompts * wip * add windows, update judges * improve * upgrade * size update * rm toon format, improve workflow, cluster agents/prompts by issue type, improve prompt cache * improve general workflow, fix bugs * sarif via script, cluster manifest * fix bugs * fix workflow2 * workflow updates * more fixes * more fixes * improvements * update readme * update codeowners * update codeowners2 * fix small inconsistencies * Address review feedback on c-review plugin Critical: - Move SKILL.md into named skill subdirectory (plugins/c-review/skills/c-review/) so plugin discovery and the Codex validator find it; add .codex/skills/c-review symlink. - Convert allowed-tools in SKILL.md from YAML list to space-delimited string (spec compliance per #139). - Fix parse_scalar in generate_sarif.py to respect quoted strings when splitting inline lists; ["a,b", c] no longer corrupts to ['"a', 'b"', 'c']. - Fix location_parts trailing-colon handling so 'src/foo.c:' resolves to ('src/foo.c', 1) instead of keeping the colon in the filename. Important: - Convert agent tools: from YAML list to comma-separated string in worker, dedup-judge, fp-judge. - Refactor build_run_plan.py main() (131 → 77 lines) by extracting _validate_run_inputs / _render_workers / _print_summary helpers. - Fix ty possibly-missing-attribute warning by typing workers list explicitly. - Add PEP 723 inline metadata + plugins/c-review/scripts/pyproject.toml. - Rewrite SKILL.md description as scenario-based; add When to Use / When NOT to Use section headers. - Add Usage section to README. - Resolve Tier 2 contradiction in dedup-judge: unparseable/multi findings now skip Tier 2 and go straight to Tier 3. - Standardize placeholder convention in fp-judge ({var} not <var>). - Fix "Widthness Overflows" → "Width Truncation" in integer-overflow-finder. - Standardize "Bug Patterns to Find" heading in signal-handler and thread-safety finders. - Replace ls -1 glob in worker shard-write with find for shell portability. - Bump version 1.1.0 → 1.1.1 in plugin.json + marketplace.json. Verification: codex validator passes (73 plugin skills); ruff + ty clean; main() 77 lines (limit 100); SARIF generator runtime tests pass; end-to-end build_run_plan.py produces all 11 clusters with cache primer. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Address claude[bot] review feedback on c-review - Phase 1 is_posix/is_windows probes in SKILL.md now include C++ extensions (.cpp, .cxx, .cc, .hpp, .hh) in their --include lists. A pure C++ POSIX daemon was silently dropping ~17 POSIX-gated passes plus all is_windows clusters because pthread.h / windows.h includes only in .cpp/.hpp files failed both --include='*.c' --include='*.h' filters. - generate_sarif.py informationUri points at trailofbits/skills (the actual repo) instead of trailofbits/tob-skills (404). - CODEOWNERS: add @dguido co-owner to /plugins/c-review/ and move it to the top of the c* alphabetical group (- < l < o < u under ASCII collation). - README.md: move c-review row after burpsuite-project-parser (b < c). - Bump version 1.1.1 → 1.1.2. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Dan Guido <dan@trailofbits.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1.6 KiB
1.6 KiB
name, description
| name | description |
|---|---|
| filesystem-issues-finder | Detects symlink attacks and temp file vulnerabilities |
Finding ID Prefix: FS (e.g., FS-001, FS-002)
Bug Patterns to Find:
-
Symlink/Softlink Issues
- Following symlinks in privileged code
- Symlink TOCTOU attacks
- Directory traversal via symlinks
-
Disk Synchronization Issues
- Missing fsync/fdatasync
- Data corruption on crash
- Write ordering bugs
-
Unquoted Path Issues
- Paths with spaces not quoted
- Shell injection via paths
-
Missing Path Separators
/path/filesvs/path/files/behavior/path/filesvs/path/files_sensitive
-
Case and Normalization
- Case-insensitive filesystem issues
- Unicode normalization bypasses
- Path canonicalization bugs
-
Predictable Temp Files
- Using tmpnam/tempnam/mktemp
- Predictable temp file names
- Insecure temp directory permissions
Common False Positives to Avoid:
- O_NOFOLLOW used: Symlink following explicitly prevented
- Hardcoded trusted paths: Paths to system files that can't be manipulated
- User's own directory: Operations in user's home dir by user's own process
- Already canonicalized: Path passed through realpath() or similar
- Directory fd operations: openat() with directory fd avoids races
- Root-only writable directory: Symlink attacks require write access
Search Patterns:
open\s*\(|fopen\s*\(|stat\s*\(|lstat\s*\(
readlink\s*\(|symlink\s*\(|realpath\s*\(
tmpnam|tempnam|mktemp|mkstemp|tmpfile
fsync\s*\(|fdatasync\s*\(
O_NOFOLLOW|O_DIRECTORY