T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:70- Finding
Arbitrary Command Execution Through Unquoted find Arguments
- Content
View full analysis
" find ${3:-.} -name $2 2>/dev/null | head -20 } ``` The same unsafe expansion pattern occurs in the other command handlers: ```bash find ${3:-.} -type f -size +${2:-1M} 2>/dev/null | head -20 find ${2:-.} -type f -mtime -${3:-7} 2>/dev/null | head -20 find ${3:-.} -name '*.$2' 2>/dev/null | head -20 find ${2:-.} -empty 2>/dev/null | head -20 find ${2:-.} -type f -printf '%s %p ' 2>/dev/null | sort -rn | head -${3:-10} ``` ### Technical Analysis `main` removes the command name with `shift` before invoking each handler: ```bash name) shift; cmd_name "$@" ;; ``` After that operation, the first documented command argument is `$1` and the second is `$2`. However, the handlers incorrectly read arguments from `$2` and `$3`. This off-by-one error causes the documented directory argument to be interpreted as another parameter while the intended first argument is ignored. More importantly, positional parameters are expanded without double quotes in calls to `find`. Bash consequently performs word splitting and pathname expansion. An attacker-controlled argument can therefore become multiple `find` expression tokens rather than one filename pattern or path. GNU `find` supports action predicates such as `-exec`. Injecting these tokens allows a search command to execute an arbitrary local program. This is expression injection into `find`, not merely malformed search input. Although the `type` handler single-quotes its name expression, its path expansion remains unsafe if a third handler argument is supplied. The other handlers simila ...[truncated 1907 chars]- Remediation
View remediation
[dir]" [ "$#" -le 2 ] || die "Usage: $SCRIPT_NAME name [dir]" find "$dir" -name "$pattern" 2>/dev/null | head -n 20 } ``` Apply the same indexing, quoting, argument-count checks, and type validation to every other handler. For example: ```bash cmd_recent() { local dir="${1:-}" local days="${2:-7}" [ -z "$dir" ] && die "Usage: $SCRIPT_NAME recent [days]" [[ "$days" =~ ^[0-9]+$ ]] || die "Days must be a non-negative integer" find "$dir" -type f -mtime "-$days" 2>/dev/null | head -n 20 } ``` ]]>