T09 · Insecure Skill Coding Practices
Error
- Location
scripts/deploy.js:47- Finding
OS Command Injection Through Deployment Inputs
- Content
View full analysis
input.includes('github.com') || '请输入有效的GitHub URL' }, { type: 'input', name: 'repoName', message: '仓库名称 (用于README):', default: 'e2e-test-recorder' } ]); execSync(`git remote add origin ${answers.repoUrl}`, { stdio: 'inherit' }); ``` ### Technical Analysis The deployment workflow inserts interactive input directly into shell command strings executed by `execSync`. Node.js invokes these strings through a shell, so quotes, separators, command substitutions, redirections, and other shell syntax are interpreted rather than treated as literal Git arguments. The repository URL validation only checks whether the input contains the substring `github.com`. It does not parse the URL, verify the hostname, or reject shell metacharacters. The commit message is not validated at all. Enclosing the commit message in double quotes is insufficient because an attacker can supply a closing quote or command substitution syntax. ### Attack Path 1. An attacker convinces a user to run `node scripts/deploy.js` with attacker-supplied deployment values. 2. The attacker supplies a repository value containing `github.com` followed by shell syntax, or supplies a malicious commit message. 3. The substring-based URL validation accepts the repository value. 4. `execSync` passes the assembled string to the operating-system shel ...[truncated 647 chars]- Remediation
View remediation