T09 · Insecure Skill Coding Practices
Error
- Location
index.js:17- Finding
Shell Command Injection Through Repository Paths and Date Arguments
- Content
View full analysis
/dev/null || echo ""`; const output = execSync(cmd, { encoding: 'utf-8' }).trim(); if (output) { output.split('\n').forEach(line => { const [hash, message, author, date] = line.split('|'); if (hash && message) { commits.push({ hash, message, author, date, repo }); } }); } } catch (e) { // 忽略错误 } } } ``` The command-line date values are accepted without validation: ```js case 'range': const fromIdx = args.indexOf('--from'); const toIdx = args.indexOf('--to'); since = fromIdx !== -1 ? args[fromIdx + 1] : today.toISOString().split('T')[0]; until = toIdx !== -1 ? args[toIdx + 1] : new Date(today.getTime() + 86400000).toISOString().split('T')[0]; break; ``` Repository paths are loaded from a working-directory configuration file and passed to the vulnerable function: ```js let config = { git: { repos: ['.'] }, output: { language: 'zh-CN' } }; const configPath = path.join(process.cwd(), '.reportrc.json'); if (fs.existsSync(configPath)) { try { config = { ...config, ...JSON.parse(fs.readFileSync(configPath, 'utf-8')) }; } catch (e) {} } // 获取提交并生成报告 const commits = getGitLogs(since, until, config.git.repos); ``` ### Technical Analysis The application constructs a shell command by directly interpolating `repo`, `since`, and `until`, then executes it through `execSync()`. These values originate from `.reportrc.json` ...[truncated 2261 chars]- Remediation
View remediation