T09 · Insecure Skill Coding Practices
Warning
- Location
sender.js:69- Finding
Unescaped File Path Allows QQ Media-Tag Injection
- Content
View full analysis
${absPath}`; } ``` ### Technical Analysis `generateTag()` places an attacker-influenced filesystem path directly inside a QQ media tag without rejecting or escaping markup characters. Unix filesystem names can contain characters such as `<`, `>`, and newlines. If the command output is consumed by a QQBot or agent runtime that interprets ``, ``, or related tags, a crafted path can close the original tag and introduce additional tags. This changes the output from a reference to one selected file into instructions to process other local paths. For example, an attacker can construct nested directories whose names contain closing and opening tags. Directory separators in the resulting absolute path can then form an injected absolute path: ```text /tmp/x/etc/passwd/payload.txt ``` The resulting output can contain an independently interpreted tag equivalent to: ```text /etc/passwd ``` The vulnerability is in tag generation itself. Successful disclosure depends on the surrounding runtime interpreting the printed tags, as described by the skill documentation. ### Attack Path 1. An attacker creates a nested path containing QQ closing and opening tag syntax. 2. The attacker convinces a user or automated agent to process that path, or places it in a directory subsequently scanned by the skill. 3. `sendFile()` passes the path to `generateTag()`. 4. `generateTag()` resolves the path but does not remove tag delimiters or control characters. 5. The script prints the resulting injected tag through `console.log()`. 6. A surrounding QQBot or agent runtime interpret ...[truncated 729 chars]- Remediation
View remediation
` - `<` and `>` - Newline and carriage-return characters - Symlinks targeting files outside the approved root 8. Ensure the consumer treats command output as plain status text unless a separately authenticated, validated media-send operation is requested. ]]>