T09 · Insecure Skill Coding Practices
Error
- Location
app.py:190- Finding
Arbitrary Code Execution Through Unsafe eval() of Chunk-Size Input
- Content
View full analysis
2: FILE_PATH = sys.argv[1] CHUNK_SIZE = eval(sys.argv[2]) if len(sys.argv) > 3: FILE_PATH = sys.argv[1] CHUNK_SIZE = eval(sys.argv[2]) password = sys.argv[3] ``` ```python # delete_when_unzip_multi.py:82-88 if len(sys.argv) > 2: FILE_PATH = sys.argv[1] CHUNK_SIZE = eval(sys.argv[2]) if len(sys.argv) > 3: FILE_PATH = sys.argv[1] CHUNK_SIZE = eval(sys.argv[2]) password = sys.argv[3] ``` ```python # delete_when_unzip_rar.py:159-165 if len(sys.argv) > 2: FILE_PATH = sys.argv[1] CHUNK_SIZE = eval(sys.argv[2]) if len(sys.argv) > 3: FILE_PATH = sys.argv[1] CHUNK_SIZE = eval(sys.argv[2]) password = sys.argv[3] ``` ```python # delete_when_unzip_rar_multi.py:165-171 if len(sys.argv) > 2: FILE_PATH = sys.argv[1] CHUNK_SIZE = eval(sys.argv[2]) if len(sys.argv) > 3: FILE_PATH = sys.argv[1] CHUNK_SIZE = eval(sys.argv[2]) password = sys.argv[3] ``` ### Technical Analysis `eval()` interprets its input as an unrestricted Python expression. The affected values originate directly from a GUI field or command-line argument and are not constrained to numeric syntax. An attacker who can influence the chunk-size value can invoke Python built-ins, import modules, execute operating-system commands, read or modify files, or start additional processes. Converting the eventual result to an integer does not mitigate the issue because expression side effects occu ...[truncated 1111 chars]- Remediation
View remediation