T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_tests.py:23- Finding
OS Command Injection in the Test Runner
- Content
View full analysis
tuple[int, str, str]: """ Activate conda environment and run a command. Returns (return_code, stdout, stderr) """ # Build command to activate conda env and run the command # Note: Path has no spaces, so no quoting needed conda_activate_cmd = f'call {DEFAULT_CONDA_PATH} activate {DEFAULT_ENV}' full_cmd = f"{conda_activate_cmd} && {' '.join(command)}" # Run via cmd.exe proc = subprocess.run( ["cmd.exe", "/c", full_cmd], capture_output=True, text=True, cwd=PROJECT_DIR, env=os.environ.copy() ) return proc.returncode, proc.stdout, proc.stderr ``` The untrusted test path reaches this helper as follows: ```python test_path = Path(test_dir) if not test_path.exists(): return {"error": f"Test directory not found: {test_dir}"} cmd = ["pytest", str(test_path), "-v", "--tb=short"] if junit_xml: cmd.extend(["--junit-xml", junit_xml]) returncode, stdout, stderr = activate_conda_and_run(cmd) ``` ### Technical Analysis The script initially represents the pytest invocation as an argument list, but then destroys the argument boundaries by joining the list into a single string: ```python ' '.join(command) ``` The resulting string is passed to `cmd.exe /c`, which interprets shell control characters such as `&`, `&&`, `|`, redirection operators, parentheses, and environment-variable expansions. The value supplied through `--test-dir` is included without shell quoting or escaping. Checking that the directory exists does not neutralize this issue because Windows filenames can contain some command-shell metacharacters, including `&`. An attacker able to create or reference a suitably named directo ...[truncated 1235 chars]- Remediation
View remediation