T09 · Insecure Skill Coding Practices
Error
- Location
scripts/init-project.sh:23- Finding
Command Injection Through Unescaped GNU sed Template Substitution
- Content
View full analysis
"$PROJECT_DIR/context.md" # 3. 创建 todos.md echo "创建 todos.md..." sed "s/{PROJECT_NAME}/$PROJECT_NAME/g; s/{DATE}/$DATE/g" \ "$TEMPLATE_DIR/todos.md.template" > "$PROJECT_DIR/todos.md" # 4. 创建 milestones.md echo "创建 milestones.md..." DATE_TIME=$(date +'%Y-%m-%d %H:%M') sed "s/{PROJECT_NAME}/$PROJECT_NAME/g; s/{DATE} {TIME}/$DATE_TIME/g" \ "$TEMPLATE_DIR/milestones.md.template" > "$PROJECT_DIR/milestones/milestones.md" # 5. 创建每个 agent 的 status 文件 echo "创建 agent status 文件..." for agent in maker vibe commander killjoy main; do AGENT_UPPER=$(echo "$agent" | tr '[:lower:]' '[:upper:]') sed "s/{AGENT}/$AGENT_UPPER/g; s/{PROJECT_NAME}/$PROJECT_NAME/g; s/{DATE} {TIME}/$DATE_TIME/g" \ "$TEMPLATE_DIR/status.md.template" > "$PROJECT_DIR/status/$agent.md" done ``` From `scripts/create-handoff.sh`: ```bash PROJECT_NAME="$1" PHASE="$2" PROJECT_DIR="/root/.openclaw/projects/$PROJECT_NAME" TEMPLATE_DIR="/root/.openclaw/skills/multi-agent-memory/templates" DATE=$(date +'%Y-%m-%d') # 1. 创建交接文档 HANDOFF_FILE="$PROJECT_DIR/handoffs/$DATE-$PHASE-交接.md" sed "s/{PROJECT_NAME}/$PROJECT_NAME/g; s/{PHASE}/$PHASE/g; s/{DATE}/$DATE/g" \ "$TEMPLATE_DIR/handoff.md.template" > "$HANDOFF_FILE" ``` From `scripts/weekly-summary.sh`: ```bash PROJECT_NAME="$1" PROJECT_DIR="/root/.openclaw/projects/$PROJECT_NA ...[truncated 3372 chars]- Remediation
View remediation
&2 exit 1 ;; esac } validate_name "$PROJECT_NAME" validate_name "$PHASE" ``` 2. Do not construct `sed` source code by directly interpolating untrusted values. Prefer a template processor that accepts replacements as data rather than executable syntax. 3. If `sed` must be retained, escape every replacement value for: - Backslashes - Ampersands - The selected delimiter - Carriage returns and newlines Merely switching from `/` to another delimiter is insufficient because an attacker may supply that delimiter as well. 4. Reject all newline and control characters even if replacement escaping is implemented. 5. Add automated negative tests containing `/`, `;`, `&`, backslashes, newlines, and strings resembling GNU `sed` commands. 6. Run these scripts under a dedicated, non-root service account with write access only to the intended project and knowledge directories. 7. Add `set -euo pipefail` so failed validation, missing templates, and failed generation operations terminate immediately rather than leaving partially initialized state. ]]>