T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:9- Finding
Unescaped Entry Values Permit JSONL Record Injection and Unsafe Terminal Output
- Content
View full analysis
> "$DATA_DIR/data.jsonl" } ``` ```bash cmd_add() { local value="${1:?Usage: mev add }" shift || true _save_entry "add" "$value $*" local count=$(wc -l < "$DATA_DIR/data.jsonl" 2>/dev/null || echo 0) echo "Added: $value (entry #$count)" } ``` ```bash tail -20 "$DATA_DIR/data.jsonl" | while IFS= read -r line; do local ts=$(echo "$line" | grep -o '"ts":"[^"]*' | cut -d'"' -f4) local cmd=$(echo "$line" | grep -o '"cmd":"[^"]*' | cut -d'"' -f4) local val=$(echo "$line" | grep -o '"val":"[^"]*' | cut -d'"' -f4) echo " [$ts] $cmd: $val" done ``` ### Technical Analysis The `_save_entry` function manually constructs JSON by inserting the entry value directly into a quoted JSON string. It does not escape quotation marks, backslashes, carriage returns, newlines, or other control characters. An attacker-controlled value can therefore: - Terminate or alter the expected JSON string. - Insert additional apparent JSONL records by including newline characters. - Corrupt the JSONL data file so subsequent parsing produces inaccurate results. - Store ANSI terminal-control sequences that are emitted when `list` or `search` displays the entry. The later parsing logic uses regular expressions rather than a JSON parser and does not validate that each line is valid JSON. This makes forged or malformed records more likely to be accepted or displayed misleadingly. ### Attack Path 1. An attacker or untrusted caller supplies an entry containing JSON delimiters, a newline, or terminal-control characters. 2. The `add` command pa ...[truncated 1185 chars]- Remediation
View remediation
> "$DATA_DIR/data.jsonl" ``` - Parse records with `jq` or another JSON-aware parser rather than using `grep` and `cut`. - Reject disallowed control characters if multiline entries are not a required feature. - Before printing untrusted stored values, encode or visibly escape non-printable and terminal-control characters. - Validate every existing JSONL line and handle malformed records without displaying raw content. - Consider writing records atomically and setting restrictive data-file permissions. ]]>