T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:108- Finding
Search Argument Option Injection and Regular Expression Abuse
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 108-119
Vulnerability Type: Search option injection and uncontrolled regular expression
Risk Level: LowVulnerable Code
bash _search() { local term="${1:?Usage: story search <term>}" echo "Searching for: $term" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local m=$(grep -i "$term" "$f" 2>/dev/null || true) if [ -n "$m" ]; then echo " --- $(basename "$f" .log) ---" echo "$m" | sed 's/^/ /' fi done }Technical Analysis
The attacker-controlled
termis supplied directly togrepwithout an option terminator. If it begins with a hyphen,grepcan interpret it as an option rather than as the intended search pattern. For example, an input such as--regexp=.*changes the effective expression and matches every log entry.The search also treats input as a regular expression. A deliberately complex expression can consume excessive CPU when evaluated against large content logs. This is not shell command injection because the variable is quoted, but quoting does not prevent option injection or regular-expression abuse.
Attack Path
- An attacker supplies or persuades a user or automation process to pass a crafted value to
story search. - The command forwards the value to
_search. grep -i "$term" "$f"interprets a leading-hyphen value as an additional command-line option.- The attacker changes the matching behavior, potentially causing all locally stored story records to be emitted.
- Alternatively, a computationally expensive regular expression is repeatedly evaluated against every log file, potentially consuming CPU resources.
Impact Assessment
Exploitation occurs with the privileges of the user running the Skill and does not provide privilege escalation or arbitrary command execution. It can alt ...[truncated 281 chars]
- An attacker supplies or persuades a user or automation process to pass a crafted value to
- Remediation
View remediation
Remediation Suggestions
Terminate option processing and use literal matching unless regular expressions are an intentional, documented feature:
bash local m m=$(grep -iF -- "$term" "$f" 2>/dev/null || true)Additional hardening should include:
- Limit the maximum length of search terms.
- If regular-expression searches are required, expose them through a separate explicit mode.
- Consider execution time or file-size limits when searching large or attacker-influenced logs.
- Add tests for search terms beginning with
-, including--regexp=.*, and terms containing regular-expression metacharacters.