T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/script.sh:67
- Finding
- Search-Term Option Injection in grep<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh:67-70` **Vulnerability Type**: Argument/option injection **Risk Level**: Medium ### Vulnerable Code ```bash cmd_search() { grep -i "$1" "$DB" 2>/dev/null || echo " Not found: $1" _log "search" "${1:-}" } ``` ### Technical Analysis The user-controlled search term is passed to `grep` without the `--` end-of-options delimiter. Quoting `"$1"` prevents shell word splitting and shell command injection, but it does not prevent `grep` from interpreting a value beginning with `-` as a command-line option. For example, a search term such as `--help` changes the operation from searching the database to displaying `grep` help. Supplying `-f` causes the following database-path argument to be treated as a pattern file; because no input file then remains, `grep` may wait for standard input. Other implementation-supported options can similarly alter matching, input interpretation, and output behavior. This is option injection rather than arbitrary shell command execution. The reviewed code does not establish a path to execute arbitrary commands or gain additional operating-system privileges. ### Attack Path 1. An attacker supplies or influences a search term beginning with a hyphen. 2. An Agent or user invokes `mindmap search` with that term. 3. `cmd_search` passes the value directly to `grep` after `-i`. 4. `grep` interprets the search term as one or more options instead of as a literal pattern. 5. The attacker changes search behavior, produces unintended output, or causes an automated process to wait for input or otherwise fail. ### Impact Assessment Exploitation occurs with the privileges of the user running the Skill. It can disrupt availability and integrity of search results, interfere with automation, and expose unintended `grep` behavior or output. No privilege escalation, persistence, network access, or arbitrary code execution was demonstrated. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions Terminate option parsing before the user-controlled search pattern: ```bash cmd_search() { if [[ $# -ne 1 || -z "$1" ]]; then echo "Usage: mindmap search <term>" >&2 return 2 fi grep -i -- "$1" "$DB" 2>/dev/null || echo " Not found: $1" _log "search" "$1" } ``` Additional hardening measures: 1. Require exactly one non-empty search argument. 2. Use `grep -F -i -- "$1" "$DB"` if search terms are intended to be literal text rather than regular expressions. 3. Distinguish “no matches” from genuine `grep` execution errors instead of treating all nonzero statuses as “not found.” 4. Add regression tests for values such as `--help`, `-f`, `-e`, empty input, and patterns beginning with a hyphen. ]]>