T09 · Insecure Skill Coding Practices
Error
- Location
scripts/project-manager.sh:158- Finding
Shell Command Injection in Generated Environment Scripts
- Content
View full analysis
"$PROJECT_ENV_FILE" << EOF # novel-free 项目环境配置 # 生成时间: $(date) NOVEL_FREE_PROJECT="$project_name" NOVEL_FREE_PROJECT_DIR="$project_dir" NOVEL_FREE_PROJECTS_DIR="$projects_dir" # 快捷命令 alias novel-status="$0 status $project_name" alias novel-backup="$SKILL_DIR/scripts/error-handler.sh backup $project_dir" alias novel-resume="$SKILL_DIR/scripts/error-handler.sh resume $project_dir" echo "已切换到项目: $project_name" echo "项目路径: $project_dir" echo "" echo "可用快捷命令:" echo " novel-status - 查看项目状态" echo " novel-backup - 备份项目" echo " novel-resume - 恢复项目" echo " $0 current - 显示当前项目" EOF echo "✅ 已切换到项目: $project_name" echo "" echo "要激活环境，请运行:" echo " source $PROJECT_ENV_FILE" echo "" echo "或者直接使用:" echo " $0 status $project_name" } ``` ```bash # scripts/project-manager.sh:286-341 create_isolated_env() { local project_name="$1" local projects_dir="${2:-$DEFAULT_PROJECTS_DIR}" local project_dir="$projects_dir/$project_name" if [[ -z "$project_name" ]]; then echo "错误: 需要指定项目名称" return 1 fi if [[ ! -d "$project_dir" ]]; then echo "错误: 项目不存在: $project_name" return 1 fi local env_script="$project_dir/isolated-env.sh" cat > "$env_script" << EOF #!/usr/bin/env bash # # novel-fr ...[truncated 3642 chars]- Remediation
View remediation
&2 return 1 fi ``` 2. Canonicalize and validate `projects_dir`, ensuring that the resolved project path remains under the intended project root. 3. Serialize every value written into shell source using shell-safe escaping: ```bash printf 'NOVEL_FREE_PROJECT=%q\n' "$project_name" printf 'NOVEL_FREE_PROJECT_DIR=%q\n' "$project_dir" ``` 4. Do not construct aliases by concatenating untrusted strings. Prefer shell functions whose arguments are stored in safely escaped variables. 5. Generate the file with a quoted heredoc only for static content, and append dynamic assignments using `printf '%q'`. 6. Consider replacing sourceable shell files with a non-executable data format such as JSON. A trusted script can parse the data and set the required environment variables. 7. Add regression tests covering quotes, semicolons, command substitution, spaces, newlines, and option-like project names. ]]>