T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bing_search.sh:21- Finding
User-Controlled max_results Value Enables Python Code Injection
- Content
View full analysis
/dev/null) ``` ### Technical Analysis The `max_results` property is extracted from attacker-supplied JSON as raw text and is not verified to be an integer. The shell comparisons attempt to enforce a range, but they do not establish that the value has a numeric JSON type or contains only decimal digits. The resulting text is subsequently interpolated directly into the source code passed to `python3 -c`: ```python matches[:$MAX_RESULTS] ``` Consequently, a crafted `max_results` string can introduce an arbitrary Python expression into the slice boundary. This is source-code injection rather than ordinary data parsing. For example, an input structurally equivalent to the following can cause Python to evaluate an attacker-controlled expression: ```json { "query": "test", "max_results": "__import__('os').system('id') or 5" } ``` After interpolation, the generated statement becomes equivalent to: ```python matches[:__import__('os').system('id') or 5] ``` The injected `os.system` call executes a local command before ...[truncated 1325 chars]- Remediation
View remediation
0) and ((.max_results // 5) | type == "number" and floor == . and . >= 1 and . <= 10) ' >/dev/null; then jq -nc '{error: "Invalid input"}' exit 1 fi MAX_RESULTS=$(echo "$JSON_INPUT" | jq -r '.max_results // 5') ``` 2. Never interpolate input values into executable Python source. Pass `MAX_RESULTS` as a positional argument and parse it as an integer inside Python: ```bash python3 parser.py "$MAX_RESULTS" ``` ```python import sys max_results = int(sys.argv[1]) if not 1 <= max_results <= 10: raise ValueError("max_results must be between 1 and 10") ``` 3. Move the parser into a fixed `.py` file rather than dynamically constructing code for `python3 -c`. 4. Return a controlled error for malformed JSON, incorrect types, and out-of-range values. Add regression tests using strings, arrays, objects, floating-point values, and Python-expression payloads as `max_results`. ]]>