T09 · Insecure Skill Coding Practices
Error
- Location
scripts/thesis.sh:398- Finding
OS Command Injection Through Unsanitized GNU bc Input
- Content
View full analysis
- Remediation
View remediation
&2 return 1 fi if (( duration < 1 || duration > 1440 )); then printf 'Error: duration is outside the permitted range.\n' >&2 return 1 fi local method_minutes=$((duration * 40 / 100)) local result_minutes=$((duration * 25 / 100)) # Use $method_minutes and $result_minutes in the generated table. } ``` Additional hardening measures: 1. Replace `bc` with Bash integer arithmetic because fractional precision is not required by the existing `scale=0` expressions. 2. Validate input before passing it to any interpreter, regardless of shell quoting. 3. Apply explicit minimum and maximum bounds to prevent unreasonable values and arithmetic edge cases. 4. Avoid reconstructing and reparsing all arguments through `$*`, `sed`, and `IFS`; pass positional arguments directly to preserve clear trust boundaries. 5. Add regression tests covering newlines, shell metacharacters, negative values, decimal values, alphabetic input, empty input, and excessively large integers. 6. If `bc` must remain in use, pass only values that have already matched a strict numeric allowlist and disable or avoid implementations with shell-escape extensions where possible. ]]>