T09 · Insecure Skill Coding Practices
Error
- Location
check.sh:5- Finding
Unvalidated Server Host Permits Shell and SSH Argument Injection
- Content
View full analysis
/dev/null | sort -rh | head -8 else ssh root@$SERVER_HOST "du -h --max-depth=2 /root 2>/dev/null | sort -rh | head -8" fi if [ "$SERVER_HOST" = "localhost" ]; then find /root -type f -size +100M 2>/dev/null -exec du -h {} + | sort -rh | head -5 else ssh root@$SERVER_HOST "find /root -type f -size +100M 2>/dev/null -exec du -h {} + | sort -rh | head -5" fi $CMD_PREFIX free -h ``` From `cleanup.sh`: ```bash SERVER_HOST="${1:-localhost}" SERVER_NAME="${2:-本地}" DRY_RUN="${3:-false}" if [ "$SERVER_HOST" = "localhost" ]; then CMD_PREFIX="" else CMD_PREFIX="ssh root@$SERVER_HOST" fi $CMD_PREFIX df -h / | tail -1 $CMD_PREFIX "npm cache clean --force 2>&1 | grep -v 'npm warn'" $CMD_PREFIX " if [ -d ~/.cache/ms-playwright ]; then cd ~/.cache/ms-playwright LATEST=\$(ls -d chromium-* 2>/dev/null | sort -V | tail -1 | sed 's/chromium-//') if [ -n \"\$LATEST\" ]; then echo \"保留最新版本: \$LATEST\" for dir in chromium-* chromium_headless_shell-*; do if [[ \$dir != *\$LATEST* ]] && [ -d \"\$dir\" ]; then echo \"删除旧版本: \$dir\" rm -rf \"\$dir\" fi done fi fi " $CMD_PREFIX df -h / | tail -1 ``` ### Technical Analysis The scripts accept `SERVER_HOST` directly from the first positional argument and incorporate it into a command stored as a scalar string: ```bash CMD_PREFIX="ssh root@$SERVER_HOST" ``` The command ...[truncated 2296 chars]- Remediation
View remediation