T09 · Insecure Skill Coding Practices
Warning
- Location
- web-search.sh:165
- Finding
- Untrusted API Content Is Interpreted as Terminal Escape Sequences<![CDATA[ ## Vulnerability Details **File Location**: `web-search.sh:165-189`, with vulnerable output sinks at `web-search.sh:225`, `web-search.sh:252`, `web-search.sh:278`, and `web-search.sh:318` **Vulnerability Type**: Terminal control-sequence injection through unsafe `echo -e` usage **Risk Level**: Medium ### Vulnerable Code ```bash # Parse fields controlled by the remote API response ANSWER=$(echo "$RESPONSE" | jq -r '.Answer // empty' | tr -d '\r\n') ABSTRACT=$(echo "$RESPONSE" | jq -r '.Abstract // empty' | tr -d '\r\n') DEFINITION=$(echo "$RESPONSE" | jq -r '.Definition // empty' | tr -d '\r\n') RELATED_TOPICS=$(echo "$RESPONSE" | jq -r '.RelatedTopics[]?.Text // empty' 2>/dev/null | head -5) # Later output sinks echo -e " $ANSWER" echo -e " $ABSTRACT" echo -e " $DEFINITION" echo "$RELATED_TOPICS" | while read -r topic; do if [ -n "$topic" ] && [ "$topic" != "" ]; then topic_clean=$(echo "$topic" | sed -E 's/<a[^>]*href="([^"]*)"[^>]*>([^<]*)<\/a>/\2 (\1)/g' | sed 's/<[^>]*>//g') if [ "$OUTPUT_FORMAT" = "markdown" ]; then echo "- $topic_clean" else echo -e " • $topic_clean" fi fi done | head -n "$MAX_RELATED" ``` ### Technical Analysis The script treats fields returned by the DuckDuckGo API as trusted terminal text. Although some fields have carriage returns and line feeds removed, this does not remove other control characters. Moreover, `echo -e` interprets backslash escape notation contained in its arguments. Consequently, a response containing an actual escape character or text such as `\033]...` can cause the terminal to interpret the response as a control sequence rather than display it as inert text. Removing HTML tags from related topics does not mitigate terminal escape-sequence injection. Potential terminal-dependent effects include: - Rewriting or hiding displayed output. - Forging status messages or result boundaries. - Changing terminal titles or hyperlinks. - Trigg ...[truncated 1644 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Never use `echo -e` for untrusted or remotely supplied values. Print data literally: ```bash printf ' %s\n' "$ANSWER" printf ' %s\n' "$ABSTRACT" printf ' %s\n' "$DEFINITION" printf ' • %s\n' "$topic_clean" ``` 2. Apply an explicit control-character policy before printing remote data. For terminal output, remove C0 and C1 controls other than any deliberately permitted whitespace: ```bash sanitize_terminal_text() { LC_ALL=C tr -d '\000-\010\013\014\016-\037\177' } ``` 3. Keep ANSI formatting in constant format strings only: ```bash printf '%b %s%b\n' "$GREEN" "$ANSWER" "$NC" ``` 4. Apply the same sanitization to all remote fields, including headings, source names, URLs, abstracts, definitions, answers, and related topics. 5. Add regression tests containing literal ESC characters and strings such as `\033[2J`, verifying that they are displayed inertly or removed. ]]>