T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/glab-mr-await.sh:18
- Finding
- Command Injection Through Unvalidated MR Wait Timeout## Vulnerability Details **File Location**: `scripts/glab-mr-await.sh`, lines 18-30 and 99 **Vulnerability Type**: Unvalidated input evaluated in a Bash arithmetic context **Risk Level**: High ### Vulnerable Code ```bash TIMEOUT="${TIMEOUT:-3600}" # Default 1 hour # Parse args shift || true while [[ $# -gt 0 ]]; do case $1 in --timeout|-t) TIMEOUT="$2" shift 2 ;; ``` ```bash if [[ $ELAPSED -ge $TIMEOUT ]]; then echo "⏰ Timeout after ${TIMEOUT}s" exit 1 fi ``` ### Technical Analysis `TIMEOUT` can originate from either the process environment or the `--timeout` command-line argument. The script does not verify that it contains only a non-negative integer before using it as an operand in a Bash arithmetic comparison. Bash recursively evaluates variable contents in arithmetic contexts. Crafted arithmetic expressions can therefore cause expansions, including command substitutions embedded in array-index expressions, to be evaluated. If an attacker can influence the script environment or the argument passed by an automation agent, the comparison can become a command-execution sink. The use of quotation marks around the initial assignments does not mitigate this issue because the dangerous interpretation occurs later, inside the arithmetic comparison. ### Attack Path 1. An attacker influences a workflow, prompt, configuration, or wrapper that supplies `TIMEOUT` or `--timeout`. 2. The attacker supplies a value constructed as a Bash arithmetic expression containing a command substitution. 3. The script stores that value without validation. 4. Execution reaches `[[ $ELAPSED -ge $TIMEOUT ]]`. 5. Bash evaluates the attacker-controlled arithmetic expression and executes the embedded command. 6. The command runs with the operating-system privileges and accessible credentials of the user or automation account running the skill. ### Impact Assess ...[truncated 510 chars]
- Remediation
- ## Remediation Suggestions Validate all numeric settings immediately after argument parsing and before any arithmetic operation: ```bash if [[ ! "$TIMEOUT" =~ ^[0-9]+$ ]]; then echo "Error: timeout must be a non-negative integer" >&2 exit 2 fi ``` Additional hardening should include: - Check that `--timeout` has a following value before reading `$2`. - Impose a reasonable upper bound to prevent excessive execution time. - Validate `MR_NUMBER` as an integer before passing it to `glab`. - Validate every environment-derived value before using it in arithmetic or command construction. - Avoid passing arguments generated directly from untrusted issue, merge-request, or prompt content.