T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:16- Finding
Arbitrary Python Code Execution Through Unsafe Heredoc Interpolation
- Content
View full analysis
[cuisine] [time_minutes]" return 1 fi python3 << PYEOF import json, time as t recipe = {"id": int(t.time()), "name": "$name", "cuisine": "$cuisine", "time": int("$time_mins"), "ingredients": [], "steps": [], "rating": 0, "created": t.strftime("%Y-%m-%d")} try: with open("$RECIPES_FILE") as f: data = json.load(f) except: data = [] data.append(recipe) with open("$RECIPES_FILE", "w") as f: json.dump(data, f, indent=2) print("Recipe added: {} ({}, {}min)".format("$name", "$cuisine", "$time_mins")) PYEOF } ``` ### Technical Analysis The script constructs Python programs using unquoted heredocs and inserts command-line arguments directly into Python string literals. Values such as `$name`, `$cuisine`, `$ingredient`, `$step`, `$recipe_id`, `$query`, `$rating`, and `$ingredients` are treated as Python source rather than serialized data. Shell quoting used when invoking the CLI does not make these values safe for insertion into Python source. An argument containing quotation marks, backslashes, Python syntax, or embedded newline characters can terminate the intended string or expression and introduce additional Python statements. This pattern appears in the following commands: - `add`: lines 16-27 - `ingredient`: lines 38-50 - `step`: lines 61-73 - `show`: lines 96-116 - `search`: lines 126-138 - `rate`: lines 150-162 - `random`: lines 176-189, through interpolation of the storage path - `suggest`: lines 202-222 The storage path is derived from `$HOME`, so an attacker who ...[truncated 2026 chars]- Remediation
View remediation