T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:79- Finding
Command Injection Through Unvalidated Numeric Arguments
- Content
View full analysis
255)v=255; print v }") ng=$(awk "BEGIN { v = int($g + ($i * (255 - $g) / ($count + 1))); if(v<0)v=0; if(v>255)v=255; print v }") nb=$(awk "BEGIN { v = int($b + ($i * (255 - $b) / ($count + 1))); if(v<0)v=0; if(v>255)v=255; print v }") ``` ```bash # Lines 204–209 local count="${1:-1}" echo -e "${BOLD}Random Colors (${count}):${NC}" echo "" local i for (( i = 0; i < count; i++ )); do ``` ### Technical Analysis The `rgb-to-hex`, `palette`, and `random` commands accept arguments that are intended to be decimal integers but do not validate their lexical format before using them in Bash arithmetic contexts. The comparison operators inside `[[ ... ]]` and expressions inside `(( ... ))` interpret their operands as arithmetic expressions. Bash may recursively resolve variable names and evaluate array subscripts in such expressions. Consequently, quoting the parameter expansion does not guarantee that a malicious value is treated as inert text. An input containing an arithmetic expression with a command substitution, such as an array-subscript expression, may cause the command substitution to execute when Bash evaluates the value. The palette implementation also embeds `count` di ...[truncated 1967 chars]- Remediation
View remediation
maximum )); then err "$name must be between 0 and $maximum" exit 1 fi } ``` Apply validation before arithmetic use: ```bash validate_uint "$r" "Red value" 255 validate_uint "$g" "Green value" 255 validate_uint "$b" "Blue value" 255 ``` Define conservative limits for generated output, such as: ```bash validate_uint "$count" "Palette count" 100 validate_uint "$count" "Random color count" 1000 ``` Use the `10#` prefix after validation when performing Bash arithmetic so values are interpreted as decimal rather than octal: ```bash r=$((10#$r)) g=$((10#$g)) b=$((10#$b)) count=$((10#$count)) ``` Do not interpolate values directly into AWK program text. Pass them as data with `-v`: ```bash nr=$(awk -v r="$r" -v i="$i" -v count="$count" 'BEGIN { v = int(r + (i * (255 - r) / (count + 1))) if (v < 0) v = 0 if (v > 255) v = 255 print v }') ``` Add automated negative tests covering nonnumeric strings, arithmetic expressions, array-subscript expressions, negative values, leading-zero values, excessive counts, and values above the documented bounds. ]]>