T09 · Insecure Skill Coding Practices
Error
- Location
- check.sh:5
- Finding
- Unvalidated Server Host Permits Shell and SSH Argument Injection<![CDATA[ ## Vulnerability Details **File Location**: `check.sh:5-16, 20, 26, 34, 40`; `cleanup.sh:6-17, 21, 32, 36-52, 56` **Vulnerability Type**: Command and argument injection through an unvalidated host parameter **Risk Level**: High ### Complete Code Snippet From `check.sh`: ```bash SERVER_HOST="${1:-localhost}" SERVER_NAME="${2:-本地}" if [ "$SERVER_HOST" = "localhost" ]; then CMD_PREFIX="" else CMD_PREFIX="ssh root@$SERVER_HOST" fi $CMD_PREFIX df -h / | tail -1 if [ "$SERVER_HOST" = "localhost" ]; then du -h --max-depth=2 /root 2>/dev/null | sort -rh | head -8 else ssh root@$SERVER_HOST "du -h --max-depth=2 /root 2>/dev/null | sort -rh | head -8" fi if [ "$SERVER_HOST" = "localhost" ]; then find /root -type f -size +100M 2>/dev/null -exec du -h {} + | sort -rh | head -5 else ssh root@$SERVER_HOST "find /root -type f -size +100M 2>/dev/null -exec du -h {} + | sort -rh | head -5" fi $CMD_PREFIX free -h ``` From `cleanup.sh`: ```bash SERVER_HOST="${1:-localhost}" SERVER_NAME="${2:-本地}" DRY_RUN="${3:-false}" if [ "$SERVER_HOST" = "localhost" ]; then CMD_PREFIX="" else CMD_PREFIX="ssh root@$SERVER_HOST" fi $CMD_PREFIX df -h / | tail -1 $CMD_PREFIX "npm cache clean --force 2>&1 | grep -v 'npm warn'" $CMD_PREFIX " if [ -d ~/.cache/ms-playwright ]; then cd ~/.cache/ms-playwright LATEST=\$(ls -d chromium-* 2>/dev/null | sort -V | tail -1 | sed 's/chromium-//') if [ -n \"\$LATEST\" ]; then echo \"保留最新版本: \$LATEST\" for dir in chromium-* chromium_headless_shell-*; do if [[ \$dir != *\$LATEST* ]] && [ -d \"\$dir\" ]; then echo \"删除旧版本: \$dir\" rm -rf \"\$dir\" fi done fi fi " $CMD_PREFIX df -h / | tail -1 ``` ### Technical Analysis The scripts accept `SERVER_HOST` directly from the first positional argument and incorporate it into a command stored as a scalar string: ```bash CMD_PREFIX="ssh root@$SERVER_HOST" ``` The command ...[truncated 2296 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate `SERVER_HOST` before using it. Accept only a strict IPv4, IPv6, or DNS-name format and reject whitespace, control characters, shell metacharacters, leading hyphens, and embedded SSH options. 2. Do not store a command in a scalar string. Use a Bash array: ```bash if [ "$SERVER_HOST" = "localhost" ]; then df -h / else ssh_cmd=(ssh -- "root@$SERVER_HOST") "${ssh_cmd[@]}" df -h / fi ``` 3. Quote every host and destination expansion: ```bash ssh -- "root@$SERVER_HOST" "df -h /" ``` 4. Add an explicit allowlist of approved servers and fail closed when the host is not listed. 5. Use a restricted maintenance account instead of `root`. 6. Add automated tests with whitespace, wildcard, option-like, and malformed host values to verify that unsafe input is rejected. 7. Apply the same correction to both `check.sh` and `cleanup.sh`. ]]>