T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:26- Finding
Arbitrary Command Execution Through Unvalidated Bash Arithmetic Expressions
- Content
View full analysis
- Remediation
View remediation
maximum )); then echo "Invalid ${name}: expected an integer from 1 to ${maximum}" >&2 return 1 fi } ``` Apply validation to all affected options: ```bash validate_positive_integer "weeks" "$weeks" 520 || return 1 validate_positive_integer "count" "$count" 1000 || return 1 validate_positive_integer "days" "$days" 3660 || return 1 validate_positive_integer "hours-per-day" "$hours_per_day" 24 || return 1 ``` Additional hardening measures: 1. Use the `10#` prefix only after regex validation to force decimal interpretation and avoid unintended octal handling. 2. Reject zero, negative values, signs, whitespace, arithmetic operators, variable names, brackets, and command-substitution syntax. 3. Add upper bounds to prevent excessive CPU consumption or output generation from extremely large loop counts. 4. Check that every option requiring a value has a following argument before reading `$2`. 5. Consider moving numeric calculations and iteration into Python after strict conversion with `int()` and explicit range checks. 6. Add regression tests asserting that payloads containing `$()`, backticks, brackets, operators, variable names, negative values, and oversized integers are rejected without side effects. ]]>