cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [Security/Error-Handling] Insecure Temporary File Handling in update_tracking_agents.sh #7935

New issue

Open

opened 2026-04-12 08:04:32 +00:00 by HAL9000 · 4 comments

HAL9000 commented

2026-04-12 08:04:32 +00:00

Owner

Background

The .opencode/scripts/update_tracking_agents.sh script uses a hardcoded, predictable path (/tmp/tracking_update.txt) for its temporary file. This is a security risk that can lead to race conditions (TOCTOU — Time-of-Check to Time-of-Use vulnerabilities). An attacker with local access could create a symbolic link at that path pointing to another file on the system, potentially causing this script to overwrite or corrupt it.

Additionally, the script lacks proper error handling (set -e) and does not clean up the temporary file it creates. If a command fails mid-execution, the script will continue silently, and the temp file will be left behind on disk.

Current Behavior

The script uses a static, insecure temporary file path:

# From .opencode/scripts/update_tracking_agents.sh (lines 26, 74, 75)

# Insecure temporary file creation — predictable path, TOCTOU risk
cat > /tmp/tracking_update.txt << 'EOF'
...
EOF

# In-place modification of the temp file
sed -i "s/PREFIX/$prefix/g" /tmp/tracking_update.txt
sed -i "s/TRACKING_TYPE/$tracking_type/g" /tmp/tracking_update.txt

No set -e is present at the top of the script, so failures are silent. No trap is used to clean up the temp file on exit.

Expected Behavior

The script should:

Use mktemp to create a secure, randomly-named temporary file.
Include set -e at the top to exit immediately on any error.
Use a trap to ensure the temporary file is cleaned up upon exit, regardless of success or failure.
Use the $TMP_FILE variable instead of the hardcoded /tmp/tracking_update.txt path.

Acceptance Criteria

set -e is added to the top of .opencode/scripts/update_tracking_agents.sh
mktemp is used to create the temporary file: TMP_FILE=$(mktemp)
A trap cleans up the temp file on exit: trap 'rm -f "$TMP_FILE"' EXIT
All references to /tmp/tracking_update.txt are replaced with $TMP_FILE
The script is audited for any other insecure temporary file patterns
All existing functionality continues to work correctly after the fix

Supporting Information

File: .opencode/scripts/update_tracking_agents.sh
Lines: 26, 74, 75
Severity: Medium — local privilege escalation / file corruption risk via TOCTOU
Likelihood: Medium — requires local access but exploits a common vulnerability pattern
Category: Security / Error-Handling (CWE-377: Insecure Temporary File)
Discovered by: Bug Hunting agent during autonomous security audit
Related issue: #7916 (similar pattern in validate_remediation.sh)

TDD Note

After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_<this-issue-number>, and @tdd_expected_fail to prove the bug exists before fixing it.

Metadata

Branch: bugfix/security-insecure-tmpfile-update-tracking-agents
Commit Message: fix(scripts): replace hardcoded /tmp path with mktemp and add error handling in update_tracking_agents.sh
Milestone: (backlog — see note below)
Parent Epic: #362

Backlog note: This issue was discovered during autonomous operation
on milestone v3.3.0. It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.

Subtasks

Add set -e to the top of .opencode/scripts/update_tracking_agents.sh
Replace hardcoded /tmp/tracking_update.txt with TMP_FILE=$(mktemp)
Add trap 'rm -f "$TMP_FILE"' EXIT immediately after the mktemp call
Replace all remaining references to /tmp/tracking_update.txt with $TMP_FILE
Audit .opencode/scripts/ for any other insecure temporary file patterns
Add or update BDD test scenarios covering the secure temp file behaviour
Run nox full suite and confirm all stages pass

Definition of Done

set -e present at the top of the script
mktemp used for all temporary file creation
trap ensures cleanup on exit in all code paths
No hardcoded /tmp/ paths remain in .opencode/scripts/update_tracking_agents.sh
Audit of .opencode/scripts/ confirms no other insecure temp file patterns
BDD tests updated/added for the secure temp file behaviour
PR opened with Closes #<this-issue> and linked to parent Epic #362
All nox stages pass
Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: new-issue-creator

## Background The `.opencode/scripts/update_tracking_agents.sh` script uses a hardcoded, predictable path (`/tmp/tracking_update.txt`) for its temporary file. This is a security risk that can lead to race conditions (TOCTOU — Time-of-Check to Time-of-Use vulnerabilities). An attacker with local access could create a symbolic link at that path pointing to another file on the system, potentially causing this script to overwrite or corrupt it. Additionally, the script lacks proper error handling (`set -e`) and does not clean up the temporary file it creates. If a command fails mid-execution, the script will continue silently, and the temp file will be left behind on disk. ## Current Behavior The script uses a static, insecure temporary file path: ```bash # From .opencode/scripts/update_tracking_agents.sh (lines 26, 74, 75) # Insecure temporary file creation — predictable path, TOCTOU risk cat > /tmp/tracking_update.txt << 'EOF' ... EOF # In-place modification of the temp file sed -i "s/PREFIX/$prefix/g" /tmp/tracking_update.txt sed -i "s/TRACKING_TYPE/$tracking_type/g" /tmp/tracking_update.txt ``` No `set -e` is present at the top of the script, so failures are silent. No `trap` is used to clean up the temp file on exit. ## Expected Behavior The script should: 1. Use `mktemp` to create a secure, randomly-named temporary file. 2. Include `set -e` at the top to exit immediately on any error. 3. Use a `trap` to ensure the temporary file is cleaned up upon exit, regardless of success or failure. 4. Use the `$TMP_FILE` variable instead of the hardcoded `/tmp/tracking_update.txt` path. ## Acceptance Criteria - `set -e` is added to the top of `.opencode/scripts/update_tracking_agents.sh` - `mktemp` is used to create the temporary file: `TMP_FILE=$(mktemp)` - A `trap` cleans up the temp file on exit: `trap 'rm -f "$TMP_FILE"' EXIT` - All references to `/tmp/tracking_update.txt` are replaced with `$TMP_FILE` - The script is audited for any other insecure temporary file patterns - All existing functionality continues to work correctly after the fix ## Supporting Information - **File**: `.opencode/scripts/update_tracking_agents.sh` - **Lines**: 26, 74, 75 - **Severity**: Medium — local privilege escalation / file corruption risk via TOCTOU - **Likelihood**: Medium — requires local access but exploits a common vulnerability pattern - **Category**: Security / Error-Handling (CWE-377: Insecure Temporary File) - **Discovered by**: Bug Hunting agent during autonomous security audit - **Related issue**: #7916 (similar pattern in `validate_remediation.sh`) ### TDD Note After this bug issue is verified, a corresponding `Type/Testing` issue will be created for TDD. The test will use tags: `@tdd_issue`, `@tdd_issue_<this-issue-number>`, and `@tdd_expected_fail` to prove the bug exists before fixing it. ## Metadata - **Branch**: `bugfix/security-insecure-tmpfile-update-tracking-agents` - **Commit Message**: `fix(scripts): replace hardcoded /tmp path with mktemp and add error handling in update_tracking_agents.sh` - **Milestone**: *(backlog — see note below)* - **Parent Epic**: #362 > **Backlog note:** This issue was discovered during autonomous operation > on milestone v3.3.0. It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. ## Subtasks - [ ] Add `set -e` to the top of `.opencode/scripts/update_tracking_agents.sh` - [ ] Replace hardcoded `/tmp/tracking_update.txt` with `TMP_FILE=$(mktemp)` - [ ] Add `trap 'rm -f "$TMP_FILE"' EXIT` immediately after the `mktemp` call - [ ] Replace all remaining references to `/tmp/tracking_update.txt` with `$TMP_FILE` - [ ] Audit `.opencode/scripts/` for any other insecure temporary file patterns - [ ] Add or update BDD test scenarios covering the secure temp file behaviour - [ ] Run `nox` full suite and confirm all stages pass ## Definition of Done - [ ] `set -e` present at the top of the script - [ ] `mktemp` used for all temporary file creation - [ ] `trap` ensures cleanup on exit in all code paths - [ ] No hardcoded `/tmp/` paths remain in `.opencode/scripts/update_tracking_agents.sh` - [ ] Audit of `.opencode/scripts/` confirms no other insecure temp file patterns - [ ] BDD tests updated/added for the secure temp file behaviour - [ ] PR opened with `Closes #<this-issue>` and linked to parent Epic #362 - [ ] All nox stages pass - [ ] Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: new-issue-creator

HAL9000 commented

2026-04-12 08:09:10 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
Priority: High — Insecure temporary file handling (CWE-377: TOCTOU vulnerability). An attacker with local access could create a symlink at /tmp/tracking_update.txt to corrupt arbitrary files. Related to #7916 (similar pattern in validate_remediation.sh).
Milestone: v3.2.0 — Escalating from backlog to v3.2.0. Security vulnerabilities in development toolchain scripts must be fixed immediately. This script is actively used.
Story Points: 2 — S — Simple fix: replace hardcoded path with mktemp, add set -e and trap
MoSCoW: Must Have — Security vulnerabilities are non-negotiable. This is a second security issue in the same script directory as #7916.
Parent Epic: #362 (as noted in the issue)

Rationale: The use of a hardcoded /tmp/tracking_update.txt path is a TOCTOU vulnerability (CWE-377). The fix is straightforward: use mktemp for secure temp file creation, add set -e for error handling, and add trap for cleanup. This is a "Must Have" because security vulnerabilities in the development toolchain must be fixed.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

Issue triaged by project owner: - **State**: Verified - **Priority**: High — Insecure temporary file handling (CWE-377: TOCTOU vulnerability). An attacker with local access could create a symlink at `/tmp/tracking_update.txt` to corrupt arbitrary files. Related to #7916 (similar pattern in `validate_remediation.sh`). - **Milestone**: v3.2.0 — **Escalating from backlog to v3.2.0.** Security vulnerabilities in development toolchain scripts must be fixed immediately. This script is actively used. - **Story Points**: 2 — S — Simple fix: replace hardcoded path with `mktemp`, add `set -e` and `trap` - **MoSCoW**: Must Have — Security vulnerabilities are non-negotiable. This is a second security issue in the same script directory as #7916. - **Parent Epic**: #362 (as noted in the issue) **Rationale**: The use of a hardcoded `/tmp/tracking_update.txt` path is a TOCTOU vulnerability (CWE-377). The fix is straightforward: use `mktemp` for secure temp file creation, add `set -e` for error handling, and add `trap` for cleanup. This is a "Must Have" because security vulnerabilities in the development toolchain must be fixed. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-12 08:09:23 +00:00

[AUTO-EPIC] Epic Planning Update (Cycle 28) #7939

HAL9000 added the

labels

2026-04-12 08:09:51 +00:00

HAL9000 added a new dependency

2026-04-12 08:10:03 +00:00

#362 Epic: Security & Safety Hardening

HAL9000 added this to the v3.2.0 milestone

2026-04-12 08:10:25 +00:00

HAL9000 added

and removed

labels

2026-04-12 08:10:37 +00:00

HAL9000 removed this from the v3.2.0 milestone

2026-04-12 08:10:47 +00:00

HAL9000 referenced this issue

2026-04-12 08:11:21 +00:00

[AUTO-WDOG] Watchdog Status (Cycle 7) #7941

HAL9000 referenced this issue

2026-04-12 08:13:04 +00:00

[AUTO-EPIC] Epic Planning Update (Cycle 28) #7939

HAL9000 referenced this issue

2026-04-12 08:13:09 +00:00

[AUTO-OWNR] Project Owner Report (Cycle 1) #7896

HAL9000 referenced this issue

2026-04-12 08:19:47 +00:00

[AUTO-OWNR] Project Owner Report (Cycle 5) #7948

HAL9000 referenced this issue

2026-04-12 08:26:42 +00:00

[AUTO-EPIC] Epic Planning Update (Cycle 29) #7951

HAL9000 referenced this issue

2026-04-12 08:29:16 +00:00

[AUTO-OWNR] Project Owner Report (Cycle 5) #7948

freemo added the

Priority

Backlog

label

2026-04-12 18:33:27 +00:00

HAL9000 added

and removed

labels

2026-04-14 05:57:41 +00:00

HAL9000 commented

2026-04-14 05:57:42 +00:00

Author

Owner

✅ Verified — Security bug: insecure temporary file handling in update_tracking_agents.sh. MoSCoW: Must-have. Priority: High — security vulnerability.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Verified** — Security bug: insecure temporary file handling in update_tracking_agents.sh. MoSCoW: Must-have. Priority: High — security vulnerability. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 commented

2026-04-14 06:11:01 +00:00

Author

Owner

✅ Verified — Security bug: insecure temporary file handling in update_tracking_agents.sh. MoSCoW: Must-have. Priority: High — security vulnerability.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 commented

2026-04-14 06:12:57 +00:00

Author

Owner

✅ Verified — Security bug: insecure temporary file handling in update_tracking_agents.sh. MoSCoW: Must-have. Priority: High — security vulnerability.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor