T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:214- Finding
Unsafe JSON Construction from User-Controlled Arguments
- Content
View full analysis
[speaker_num]}" TARGET_LANG="${2:?Usage: bash translate.sh [speaker_num] (e.g. English)}" SPEAKER_NUM="${3:-1}" # Determine if input is a URL or local file; upload local files first if [[ "$VIDEO_INPUT" == http://* ]] || [[ "$VIDEO_INPUT" == https://* ]]; then VIDEO_URL="$VIDEO_INPUT" else if [ ! -f "$VIDEO_INPUT" ]; then echo "File not found: $VIDEO_INPUT" exit 1 fi echo "Uploading local video: $VIDEO_INPUT" UPLOAD_RESPONSE=$(curl -s --location "$API_BASE/figure-resource/upload/file" \ --header "token: $API_KEY" \ --form "file=@\"$VIDEO_INPUT\"") UPLOAD_SUCCESS=$(echo "$UPLOAD_RESPONSE" | jq -r '.success') if [ "$UPLOAD_SUCCESS" != "true" ]; then echo "Upload failed:" echo "$UPLOAD_RESPONSE" | jq . exit 1 fi VIDEO_URL=$(echo "$UPLOAD_RESPONSE" | jq -r '.result.url') echo "Upload succeeded, video URL: $VIDEO_URL" fi # Step 1: Submit translation task echo "Submitting video translation task..." echo " Video: $VIDEO_URL" echo " Target language: $TARGET_LANG" echo " Speaker count: $SPEAKER_NUM" RESPONSE=$(curl -s -X POST "$API_BASE/video_translate" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"target_languages\": [\"$TARGET_LANG\"], \"video_url\": \"$VIDEO_URL\", \"speaker_num\": $SPEAKER_NUM, \"translate_audio_only\": true, \"enable_dynamic_duration\": true, \"enable_caption\": false }") ``` ### Technical Analysis The workflow directly interpolates `TARGET_LANG`, `VIDEO_URL`, and `SPEAKER_NUM` into a JSON string without JSON-safe encoding or type validation. Although shell metacharacters contained in th ...[truncated 2247 chars]- Remediation
View remediation
&2 exit 1 fi PAYLOAD=$(jq -n \ --arg target_language "$TARGET_LANG" \ --arg video_url "$VIDEO_URL" \ --argjson speaker_num "$SPEAKER_NUM" \ '{ target_languages: [$target_language], video_url: $video_url, speaker_num: $speaker_num, translate_audio_only: true, enable_dynamic_duration: true, enable_caption: false }') || exit 1 RESPONSE=$(curl --fail-with-body -sS -X POST "$API_BASE/video_translate" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ --data-binary "$PAYLOAD") ``` Additional hardening should include: 1. Verify that `TARGET_LANG` exactly matches an entry returned by the supported-languages endpoint. 2. Enforce documented bounds for `SPEAKER_NUM`, not merely numeric syntax. 3. Validate remote video URLs against the schemes and URL forms accepted by the API. 4. Confirm that uploaded responses contain a nonempty string at `result.url` before submission. 5. Use `curl --fail-with-body -sS` and explicitly handle transport errors and non-success HTTP responses. 6. Add tests containing quotation marks, backslashes, newlines, and JSON delimiters to verify that all values remain data rather than request structure. ]]>