T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:62- Finding
Unescaped User-Controlled Values Produce Invalid or Injected JSON Exports
- Content
View full analysis
> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ``` User-controlled values enter the relevant log files through each domain command. For example: ```bash local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/check.log" ``` The same input-handling pattern is repeated for the other domain commands through line 296. ### Technical Analysis The JSON exporter inserts `name`, `ts`, and `val` directly into quoted JSON string literals without JSON encoding. In particular, `val` can contain attacker-controlled quotation marks, backslashes, newlines, or other control characters. A value containing `"` can terminate the intended JSON string and introduce additional properties or objects. Backslashes and literal control characters can also make the resulting file syntactically invalid. Shell quoting prevents shell command substitution at export time, but it does not provide JSON escaping. For example, a logged value resembling the following can alter the structure of the generated document: ```text safe","injected":true,"other":"value ``` The resulting export no longer faithfully represents the original log entry and may be interpreted as attacker-supplied structured data by downstream consumers. ### Attack Path 1. An attacker influences text passed to a domain command such as `gitbuddy check`, `gitbuddy lint`, or `gitbuddy report`. 2. The command saves the supplied text verbatim in a log under `~/.local/share/gitbuddy/`. 3. The user runs `gitbuddy export json`. 4 ...[truncated 1002 chars]- Remediation
View remediation