T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:10- Finding
Stored terminal control-sequence injection and malformed JSONL record injection
- Content
View full analysis
> "$DATA_DIR/data.jsonl" } ``` The stored value is subsequently extracted and printed without terminal-safe encoding: ```bash cmd_list() { echo "=== Attestation Entries ===" if [ -f "$DATA_DIR/data.jsonl" ]; then local count=$(wc -l < "$DATA_DIR/data.jsonl") echo "Total: $count" echo "---" tail -20 "$DATA_DIR/data.jsonl" | while IFS= read -r line; do local ts=$(echo "$line" | grep -o '"ts":"[^"]*' | cut -d'"' -f4) local cmd=$(echo "$line" | grep -o '"cmd":"[^"]*' | cut -d'"' -f4) local val=$(echo "$line" | grep -o '"val":"[^"]*' | cut -d'"' -f4) echo " [$ts] $cmd: $val" done else echo "No entries yet." fi } cmd_search() { local term="${1:?Usage: attestation search }" if [ -f "$DATA_DIR/data.jsonl" ]; then local matches=$(grep -ic "$term" "$DATA_DIR/data.jsonl" 2>/dev/null || echo 0) echo "Found: $matches matches" grep -i "$term" "$DATA_DIR/data.jsonl" 2>/dev/null | head -20 | while IFS= read -r line; do local val=$(echo "$line" | grep -o '"val":"[^"]*' | cut -d'"' -f4) local ts=$(echo "$line" | grep -o '"ts":"[^"]*' | cut -d'"' -f4) echo " [$ts] $val" done else echo "No data to search." fi } ``` ### Technical Analysis `_save_entry` constructs JSON by interpolating user-controlled text directly into a format string. Although shell argument quoting prevents ordinary shell command injection at this location, it does not perform JSON encod ...[truncated 1972 chars]- Remediation
View remediation
> "$DATA_DIR/data.jsonl" ``` - Parse stored records with `jq` instead of extracting fields with `grep` and `cut`. - Reject or visibly encode non-printable terminal control characters before displaying stored values. - Use `printf '%s\n'` instead of `echo` for predictable output, but note that `printf` alone does not neutralize embedded terminal escape sequences. - Validate existing JSONL records before processing them and report malformed records without rendering their raw content. - Consider limiting entry size and rejecting embedded line breaks if multiline values are not a documented requirement. ]]>