T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:63- Finding
Unescaped Log Data Causes JSON, CSV, and Log Injection
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` The JSON exporter inserts stored values directly into JSON strings without escaping quotation marks, backslashes, control characters, or newlines: ```bash json) echo "[" > "$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; ``` The CSV exporter similarly writes fields without RFC 4180 quoting or spreadsheet-formula neutralization: ```bash csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ;; ``` Domain commands persist caller-controlled input without escaping. This pattern is repeated for `check`, `validate`, `generate`, `format`, `lint`, `explain`, `convert`, `template`, `diff`, `preview`, `fix`, and `report`: ```bash local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/check.log" local total=$(wc -l < "$DATA_DIR/check.log") echo " [Readme Maker] check: $input" echo " Saved. Total check entries: $total" _log "check" "$input" ``` ### Technical Analysis The application uses a pipe-delimited storage format but accepts arbitrary command arguments as a field value. Newlines and pipe characters ca ...[truncated 3033 chars]- Remediation
View remediation