T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:54- Finding
Improper JSON Serialization of User-Controlled Log Values
- Content
View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; ``` User-controlled values enter the affected export operation through command handlers such as: ```bash local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/add.log" ``` ### Technical Analysis The JSON exporter constructs JSON through string interpolation rather than a standards-compliant serializer. The `value` field originates from command-line input and is written to a log without validation or encoding. During export, characters with special JSON meanings—including double quotes, backslashes, carriage returns, and control characters—are inserted directly into a JSON string. For example, a value containing: ```text item"} , {"type":"injected","time":"now","value":"controlled ``` can alter the intended JSON structure or make the generated document invalid. The issue can affect any downstream process that trusts the exported JSON. The use of `echo "\n]"` is also implementation-dependent and does not provide reliable JSON formatting. ### Attack Path 1. An attacker persuades a user or automation process to record a crafted value with a command such as `fridge add`. 2. The command stores that value verbatim in `add.log`. 3. The user runs `fridge export json`. 4. `_export` interpolates the unescaped value directly into a JSON object. 5. The export becomes malformed or contains attacker-controlled JSON structure. 6. A d ...[truncated 774 chars]- Remediation
View remediation