T09 · Insecure Skill Coding Practices
Error
- Location
api/browser/open-url.js:18- Finding
OS Command Injection Through Shell-Based URL Opening
- Content
View full analysis
hostname === host || hostname.endsWith('.' + host)) } catch { return false } } async function openUrl(url) { if (!url) throw new Error('URL is required') if (!isAllowedUrl(url)) throw new Error(`URL not allowed: ${url}`) if (process.platform === 'darwin') { await execAsync(`open "${url}"`) } else if (process.platform === 'win32') { await execAsync(`start "" "${url}"`) } else { await execAsync(`xdg-open "${url}"`) } } ``` ### Technical Analysis The function validates the URL by parsing its protocol and hostname, but it subsequently interpolates the original, unnormalized input into an operating-system shell command executed through `child_process.exec`. Hostname validation does not ensure that the original string is safe for shell interpolation. An input may parse as an HTTPS URL under an allowed hostname while also containing quote characters or shell metacharacters in another URL component. Those characters can terminate the quoted command argument and introduce additional shell commands. The vulnerable function is exported and can also be invoked through the documented command-line interface. The current `processQuery` paths supply URLs from static hospital data, which limits exposure through that particular caller, but direct callers and the CLI can supply arbitrary input. ### Attack Path 1. An attacker obtains access to a code path that calls the exported `openUrl` function, or can invoke `node api/browser/open-url.js`. 2. The attacker provides a crafted HTTPS URL whose parsed hostname is `i.beautsgo.com` or a permitted subdomain. 3. The crafted URL includes quote charac ...[truncated 688 chars]- Remediation
View remediation