Skip to content

🛡️ Sentinel: [HIGH] Fix environment hijacking and arbitrary file move/deletion in install.sh #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
qapdex-maker merged 1 commit into from
Jul 31, 2026
Merged

🛡️ Sentinel: [HIGH] Fix environment hijacking and arbitrary file move/deletion in install.sh #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,3 +39,8 @@
**Vulnerability:** Use of predictable, hardcoded temporary file paths and extraction directories in a shared `/tmp` directory.
**Learning:** Using hardcoded paths for temporary files or directories (such as `TMP` and `EXTRACT_DIR` inside `/tmp` or `${PREFIX}/tmp`) makes the script vulnerable to symlink attacks, arbitrary file overwriting, and race conditions (CWE-377, CWE-59) by other local users on a shared system.
**Prevention:** Always use `mktemp -d` to securely create a unique temporary directory with restricted `0700` permissions (readable/writable only by the owner), and place all temporary files and extraction directories within it.

## 2026-07-31 - Environment Variable Hijacking and Arbitrary File Destruction via Trap Cleanup Logic
**Vulnerability:** Uninitialized critical variables in shell scripts (e.g., `ANTIGRAVITY_BAK`, `INSTALL_BIN_DIR`) can be hijacked from the parent environment, allowing users/attackers to manipulate execution flows. When coupled with script-level cleanup traps (like moving or deleting backup files on exit/cancel), uninitialized environment variables can lead to arbitrary file move or deletion operations (CWE-377, CWE-59, CWE-459).
**Learning:** Trap handlers in shell scripts run on any exit or cancellation. If the script fails or exits before variables are initialized inside the script body, pre-existing environment variables of the same name can control file operations inside the trap handler.
**Prevention:** Always explicitly initialize critical shell variables controlling backup paths, installation folders, or temporary locations at the very beginning of the script body. Additionally, validate that target variables are non-empty before executing state-altering commands like `mv` or `rm`.
14 changes: 11 additions & 3 deletions install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,14 @@
# Antigravity CLI - Termux Native (Setup)
set -Eeuo pipefail

# Security Enhancement (Sentinel): Initialize critical variables to prevent environment hijacking
# and arbitrary file deletion/move vulnerabilities (CWE-377, CWE-59, CWE-459).
ANTIGRAVITY_BAK=""
ANTIGRAVITY_VA39_BAK=""
INSTALL_BIN_DIR=""
SECURE_TMP_DIR=""
INSTALL_SUCCESS=0

REPO="${ANTIGRAVITY_REPO:-wallentx/antigravity-cli-termux}"
if [[ "$REPO" == -* || "$REPO" == *[!a-zA-Z0-9_./-]* ]]; then
printf "[ERR] Invalid ANTIGRAVITY_REPO: contains unsafe characters or starts with a dash\n" >&2
Expand Down Expand Up @@ -62,12 +70,12 @@ mkdir -p "$SECURE_TMP_DIR" 2>/dev/null || true
# ── Cleanup Hook ──────────────────────────────────────────────────────────────
cleanup() {
printf "\033[?25h" # Restore cursor if cancelled
[[ -d "$SECURE_TMP_DIR" ]] && rm -rf "$SECURE_TMP_DIR"
[[ -n "${SECURE_TMP_DIR:-}" && -d "$SECURE_TMP_DIR" ]] && rm -rf "$SECURE_TMP_DIR"
if [[ "${INSTALL_SUCCESS:-0}" -ne 1 ]]; then
if [[ -n "${ANTIGRAVITY_BAK:-}" && -f "$ANTIGRAVITY_BAK" ]]; then
if [[ -n "${INSTALL_BIN_DIR:-}" && -n "${ANTIGRAVITY_BAK:-}" && -f "$ANTIGRAVITY_BAK" ]]; then
mv -f "$ANTIGRAVITY_BAK" "$INSTALL_BIN_DIR/antigravity" || true
fi
if [[ -n "${ANTIGRAVITY_VA39_BAK:-}" && -f "$ANTIGRAVITY_VA39_BAK" ]]; then
if [[ -n "${INSTALL_BIN_DIR:-}" && -n "${ANTIGRAVITY_VA39_BAK:-}" && -f "$ANTIGRAVITY_VA39_BAK" ]]; then
mv -f "$ANTIGRAVITY_VA39_BAK" "$INSTALL_BIN_DIR/antigravity.va39" || true
fi
else
Expand Down