T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:92- Finding
Unquoted grep Arguments Permit Arbitrary Local File Disclosure
- Content
View full analysis
" grep ${2:-$(date +%Y-%m-%d)} $DATA_DIR/meals.jsonl 2>/dev/null || echo 'No meals planned' } ``` The relevant command dispatcher is: ```bash list) shift; cmd_list "$@" ;; ``` ### Technical Analysis The command dispatcher removes the `list` argument with `shift`, but `cmd_list` incorrectly reads the requested day from `$2` instead of `$1`. The value of `$2` is then expanded without quotation marks in the `grep` command: ```bash grep ${2:-$(date +%Y-%m-%d)} $DATA_DIR/meals.jsonl ``` Because this expansion is unquoted, shell word splitting converts a single attacker-controlled argument containing spaces into multiple `grep` operands. The first resulting word is treated as the search pattern, while subsequent words are treated as file paths. The absence of the `--` option terminator also allows values beginning with a hyphen to be interpreted as `grep` options. For example, the following invocation supplies a second post-shift argument containing both a pattern and a file path: ```bash scripts/script.sh list ignored '.* /etc/passwd' ``` After dispatch and shell word splitting, the effective operation is equivalent to: ```bash grep '.*' /etc/passwd "$HOME/.local/share/mealplan/meals.jsonl" ``` This causes `grep` to read and print matching content from the attacker-selected file. ### Attack Path 1. An attacker provides crafted input that is passed to the Skill's `list` command. 2. The invocation includes an arbitrary first argument and a malicious second argument, such as: ```bash scripts/script.sh list ignored '.* /etc/passwd' ``` 3. The dispatcher executes `shift`, making `ignored` becom ...[truncated 1149 chars]- Remediation
View remediation
" if [[ ! "$day" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then die "Invalid day: expected YYYY-MM-DD" fi grep --fixed-strings -- "$day" "$DATA_DIR/meals.jsonl" 2>/dev/null || echo 'No meals planned' } ``` The same positional-argument mismatch should also be corrected in the other command handlers because the dispatcher calls `shift` before invoking them. Shell-focused automated tests and a static analyzer such as ShellCheck should be added to detect unquoted expansions and incorrect argument handling. ]]>