T09 · Insecure Skill Coding Practices
Error
- Location
` or the PyMOL `@ <file>` command, as instructed by the application. 6. The injected command runs in the victim's PyMOL process. ### Impact Assessment Successful exploitation permits execution of arbitrary PyMOL commands with the permissions of the user running PyMOL. Depending on the commands and PyMOL features available in the environment, this could enable: - Unauthorized loading, reading, or writing of local files - Unintended network requests - Modification of visualization output or scientific resu ...[truncated 424 chars]:76- Finding
Unvalidated input allows injection into generated PyMOL scripts
- Content
View full analysis
Tuple[Optional[str], str, Optional[str]]: """ Parse residue specification. Formats supported: - chain:resnum:resname (A:145:ASP) - chain:resnum (A:145) - resnum (145 - assumes chain A or first chain) Returns: Tuple of (chain, resnum, resname) """ parts = residue_spec.split(":") if len(parts) == 3: return parts[0], parts[1], parts[2] elif len(parts) == 2: return parts[0], parts[1], None elif len(parts) == 1: return None, parts[0], None else: raise ValueError(f"Invalid residue specification: {residue_spec}") def _generate_selection_string(self, chain: Optional[str], resnum: str, resname: Optional[str]) -> str: """Generate PyMOL selection string for a residue.""" parts = [] if chain: parts.append(f"chain {chain}") parts.append(f"resi {resnum}") if resname: parts.append(f"resn {resname}") return " and ".join(parts) def _get_load_command(self) -> str: """Generate structure loading command.""" # Check if pdb_source is a PDB ID (4 characters, alphanumeric) if len(self.pdb_source) == 4 and self.pdb_source.isalnum(): return f"fetch {self.pdb_source}, async=0" else: return f"load {self.pdb_source}" ``` ```python # Header lines.append("# PyMOL script generated by protein-struct-viz") lines.append(f"# Target: {self.pdb_source}") lines.append(f"# Highlighted residues: {', '.join(self.residues)}") lines.append("") # Load structure lines.append("# Load structure") lines.append(self._get_load_command()) lines.append("") ``` ```python # Apply color scheme lines.append("# Color scheme") if self.color_scheme in ...[truncated 3270 chars]- Remediation
View remediation