T09 · Insecure Skill Coding Practices
Error
- Location
automd-viz.sh:149- Finding
Command Injection Through Generated PyMOL and Python Commands
- Content
View full analysis
"${OUTPUT_DIR}/pymol_script.pml" << EOF # PyMOL Publication-Quality Rendering Script load ${structure}, protein hide everything show ${style} color ${color} # High-quality rendering settings set ray_trace_mode, 1 set ray_shadows, 1 set ray_trace_fog, 0 set antialias, 2 set ambient, 0.4 set specular, 0.5 set shininess, 10 set depth_cue, 0 set ray_opaque_background, 1 # View optimization orient zoom # Output ray ${OUTPUT_DPI}, ${OUTPUT_DPI} png ${output}, dpi=${OUTPUT_DPI} quit EOF if command -v pymol &>/dev/null; then pymol -c "${OUTPUT_DIR}/pymol_script.pml" || error "PyMOL execution failed" else python3 -c "import pymol; pymol.cmd.do('run ${OUTPUT_DIR}/pymol_script.pml')" || error "PyMOL execution failed" fi ``` The affected values originate from command-line arguments or environment variables: ```bash OUTPUT_DIR="${OUTPUT_DIR:-publication-viz}" OUTPUT_DPI="${OUTPUT_DPI:-300}" STRUCTURE_STYLE="${STRUCTURE_STYLE:-cartoon}" STRUCTURE_COLOR="${STRUCTURE_COLOR:-spectrum}" ``` ```bash --structure) INPUT_STRUCTURE="$2"; shift 2 ;; --style) STRUCTURE_STYLE="$2"; shift 2 ;; --color) STRUCTURE_COLOR="$2"; shift 2 ;; -o) OUTPUT_DIR="$2"; shift 2 ;; --dpi) OUTPUT_DPI="$2"; shift 2 ;; ``` ### Technical Analysis The script directly interpolates the structure path, rendering style, color, output path, and DPI into a generated PyMOL command file. These values are not escaped and are not restricted to safe character sets or documented allowlists. A value containing a newline or other PyMOL command-language delimiters can change the generated script's command structure and append unintended PyMOL commands. The risk is particularly significant because PyMOL scripting can invoke Python functionality and interac ...[truncated 1951 chars]- Remediation
View remediation