cleanup-legacy.py: unchecked --module-code / --also-remove are passed to rmtree — '' or '.' deletes all of _bmad (agent memory included), '..' deletes the whole project

Aperta
  • Qualcosa non va?
#155 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
58/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
python
Ambito
cli, security

Direzione di ricerca

Start with skills/bmad-bmb-setup/scripts/cleanup-legacy.py and inspect how it builds targets from --module-code and --also-remove before calling shutil.rmtree; check the related copies in the module-builder template and samples/sample-module-setup/ too. Trace verify_skills_installed() and the references to issues #96 and #139. Done when invalid or out-of-scope paths are refused and _bmad/memory/ is protected.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Describe the bug

cleanup-legacy.py joins --module-code and every --also-remove value onto --bmad-dir, then calls shutil.rmtree on the result. The script is shipped in skills/bmad-bmb-setup/scripts/, the module-builder setup-skill template, and samples/sample-module-setup/. Nothing validates these values:

Value Path(bmad_dir) / value What gets deleted
--module-code "" _bmad/ all of _bmad: every module's config, _config/ manifests, and every agent's sanctum under _bmad/memory/
--module-code . _bmad/. same as above
--module-code .. _bmad/.. the whole project directory, source code included
--also-remove ../src _bmad/../src any folder outside _bmad

The --skills-dir safety check doesn't help. verify_skills_installed() skips every directory that contains no SKILL.md, so it reports skills_verified: true and removal continues. This is related to #96 (deleting live config dirs) and #121/#136 (validating module codes), but the impact here is total data loss from a single bad argument. The module code reaches this command through a {module-code} substitution done by the scaffolder or the LLM.

Steps to reproduce

C=<bmb>/skills/bmad-bmb-setup/scripts/cleanup-legacy.py
for code in "" "." ".."; do
  rm -rf /tmp/p && mkdir -p /tmp/p/_bmad/{bmm,core,memory/my-agent} /tmp/p/src && cd /tmp/p
  echo x > _bmad/memory/my-agent/MEMORY.md; echo code > src/app.py
  python3 $C --bmad-dir _bmad --module-code "$code" --skills-dir .claude/skills >/dev/null 2>&1
  echo "code='$code': _bmad=$([ -d _bmad ] && echo kept || echo DELETED) src/app.py=$([ -f src/app.py ] && echo kept || echo DELETED)"
  cd /
done
# code='':   _bmad=DELETED src/app.py=kept
# code='.':  _bmad=DELETED src/app.py=kept
# code='..': _bmad=DELETED src/app.py=DELETED   (whole project removed)

rm -rf /tmp/p && mkdir -p /tmp/p/_bmad/core /tmp/p/src && cd /tmp/p
python3 $C --bmad-dir _bmad --module-code bmb --also-remove ../src   # src/ deleted

Expected behavior

  • Require --module-code and each --also-remove value to be a single, non-empty, non-dot path segment, e.g. ^[A-Za-z0-9_][A-Za-z0-9_.-]*$ and not . or ...
  • Resolve each target and refuse anything that is not a strict child of the resolved --bmad-dir.
  • Never remove _bmad/memory/, and never remove a directory the script can't prove is a legacy skill payload (see #96 and #139).

Environment

  • Model(s) used: n/a (deterministic script)
  • Agentic IDE used: n/a (scripts run directly)
  • BMad version: bmad-builder main @ d4a921c (v2.2.2 + #118)
  • Project language: Python 3.13, Linux
Lingua principale
Python
Stelle
220
Fork
54
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di bmad-code-org/bmad-builder

Tutte le issue di bmad-code-org/bmad-builder

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.