T09 · Insecure Skill Coding Practices
- Location
protein_qc_workflow.sh:15- Finding
Unquoted User-Controlled Output Path Enables Unsafe Shell Expansion
- Content
View full analysis
Vulnerability Details
File Location:
protein_qc_workflow.sh, lines 15-16
Vulnerability Type: Improper quoting and option handling for a user-controlled filesystem path
Risk Level: MediumVulnerable Code
bash OUTPUT_DIR=$2 if [ -z "$INPUT" ] || [ -z "$OUTPUT_DIR" ]; then echo "Usage: bash protein_qc_workflow.sh input.fasta output_dir" exit 1 fi mkdir -p $OUTPUT_DIR cd $OUTPUT_DIRTechnical Analysis
OUTPUT_DIRoriginates from the second command-line argument and is expanded without double quotes in bothmkdirandcd. Unquoted shell expansion subjects the value to word splitting and pathname expansion.Consequently:
- Whitespace can turn one supplied path into multiple arguments.
- Wildcard characters such as
*,?, and bracket expressions can resolve to existing filesystem entries. - A value beginning with a hyphen can be interpreted as an option by commands that accept options.
mkdirmay create multiple unintended directories.cdmay enter an unintended directory if a wildcard resolves to a single directory, or fail when expansion produces multiple arguments.
This does not directly permit shell metacharacters embedded in the variable to execute as commands because the shell does not parse control operators again after parameter expansion. The practical risks are unintended filesystem operations, workflow redirection, and denial of service rather than arbitrary command execution.
Attack Path
- An attacker or untrusted caller controls the workflow's second argument.
- The caller passes a quoted value containing spaces, wildcard characters, or option-like text, for example:
bash bash protein_qc_workflow.sh input.fasta 'results/*' - Inside the script, the unquoted
$OUTPUT_DIRis expanded again by the shell. - If the wildcard matches filesystem entries, those entries become arguments to
mkdirandcd. - The wor ...[truncated 888 chars]
- Remediation
View remediation
Remediation Suggestions
Quote every filesystem path and use an option terminator where supported:
bash mkdir -p -- "$OUTPUT_DIR" cd -- "$OUTPUT_DIR"Apply additional hardening when the value can originate from an untrusted caller:
- Resolve the path before changing directories:
bash OUTPUT_DIR=$(realpath -m -- "$2") || exit 1 - Enforce an approved parent directory if the workflow must operate within a controlled workspace.
- Reject paths outside that workspace after canonicalization.
- Check the directory transition explicitly:
bash mkdir -p -- "$OUTPUT_DIR" && cd -- "$OUTPUT_DIR" || exit 1 - Quote all other variable expansions consistently to prevent similar defects during future modifications.
- Resolve the path before changing directories: