T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/bizyair_api.sh:101
- Finding
- Unsafe JSON Construction in the Shell API Fallback<![CDATA[ ## Vulnerability Details **File Location**: `scripts/bizyair_api.sh`, lines 101-130 **Vulnerability Type**: User-controlled JSON injection and missing numeric validation **Risk Level**: Medium ### Vulnerable Code ```bash # 解析参数 PROMPT="$1" RATIO="${2:-9:16}" BATCH_SIZE="${3:-4}" # 处理 prompt FINAL_PROMPT=$(process_prompt "$PROMPT") if [ "$FINAL_PROMPT" != "$PROMPT" ]; then echo "🤖 检测到模特关键词，已自动追加提示词" fi # 获取尺寸 read -r WIDTH HEIGHT <<< "$(get_size "$RATIO")" echo "📤 创建任务: prompt='$PROMPT', size=${WIDTH}x${HEIGHT}, batch=$BATCH_SIZE" # 创建任务 RESPONSE=$(curl -s -X POST "$API_ENDPOINT/create" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $BIZYAIR_API_KEY" \ -H "X-Bizyair-Task-Async: enable" \ --max-time 30 \ -d "{ \"web_app_id\": $WEB_APP_ID, \"suppress_preview_output\": true, \"input_values\": { \"107:BizyAirSiliconCloudLLMAPI.user_prompt\": \"$FINAL_PROMPT\", \"81:EmptySD3LatentImage.width\": $WIDTH, \"81:EmptySD3LatentImage.height\": $HEIGHT, \"81:EmptySD3LatentImage.batch_size\": $BATCH_SIZE } }") ``` ### Technical Analysis The fallback script builds JSON by directly interpolating user-controlled values into a double-quoted shell string. `FINAL_PROMPT` is inserted into a JSON string without JSON escaping, while `BATCH_SIZE` is inserted as a raw JSON value without verifying that it is an integer between 1 and 10. A prompt containing quotation marks, backslashes, newlines, or JSON delimiters can terminate or alter the intended `user_prompt` value. Depending on how the remote JSON parser handles injected or duplicate properties, this may modify other request fields or cause malformed requests. The batch argument can likewise contain arbitrary JSON syntax. More commonly, a user can submit a valid but excessively large numeric value because the shell fallback does not enforce the documented maximum batch size of 10. Shell ...[truncated 1380 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Construct the request with a JSON-aware tool instead of string interpolation. For example, use `jq` with `--arg` for strings and `--argjson` for validated numbers: ```bash if ! [[ "$BATCH_SIZE" =~ ^[0-9]+$ ]] || (( BATCH_SIZE < 1 || BATCH_SIZE > 10 )); then echo "Error: batch size must be an integer from 1 through 10" >&2 exit 1 fi PAYLOAD=$(jq -n \ --arg prompt "$FINAL_PROMPT" \ --argjson web_app_id "$WEB_APP_ID" \ --argjson width "$WIDTH" \ --argjson height "$HEIGHT" \ --argjson batch_size "$BATCH_SIZE" \ '{ web_app_id: $web_app_id, suppress_preview_output: true, input_values: { "107:BizyAirSiliconCloudLLMAPI.user_prompt": $prompt, "81:EmptySD3LatentImage.width": $width, "81:EmptySD3LatentImage.height": $height, "81:EmptySD3LatentImage.batch_size": $batch_size } }') ``` 2. Pass the resulting payload with `curl --data-binary "$PAYLOAD"`. 3. Enforce a batch range of 1 through 10 before making any network request. 4. Validate all numeric fields with strict integer syntax before using `--argjson`. 5. Use `curl --fail-with-body --show-error` and check the exit status so HTTP errors are not treated as valid API responses. 6. Add tests covering quotes, backslashes, control characters, Unicode, JSON delimiters, negative values, nonnumeric batches, and batches above 10. ]]>